Who runs this website ?
The website www.lsa-skills.co.uk is an internet property of Logistics Skills Alliance registered at Companies House No 08430140 as a Private company limited by guarantee without share capital.
What information do we have about you ?
If you are a website visitor from the general public
We record technical data about the devices and software used to view our pages and the internet addresses our visitors arrive from. We gather this data through our use of Google Analytics and Statcounter analytics - DATA A. In addition, the web server software logs access to the pages on this web site - DATA B. Your use of this website is conditional upon your acceptance of this collection.
DATA A serves the following purposes
It informs our decision-making about how to keep the site relevant and useful
DATA A resides on the servers of the analytics companies. They are therefore subsidiary data processors.
DATA B serves the following purposes
It allows the owner of the server to determine whether the site is being misused
DATA B resides on the managed server that runs this website. Access to this data is controlled by Namesco - the hosting company that manages the server for us. Namesco is therefore a subsidiary data processor.
1) Statcounter is headquartered in Ireland - within the EU.
2) Statcounter do not provide date-based statistical data expiry, they instead allow the collection size to be limited as an aggregate number of data point entries. This means that the retention period for a given collection size will be a function of the number of visitors to our site - the more visitors, the quicker the individual visitors' data will expire. We have set this collection (log) size to indicate a notional retention period of 367 days, based on current website usage patterns. We will periodically review this setting.
3) Recital 30 to Article 4, Point 1 of the GDPR Directive states that recording our visitors' IP addresses in itself constitutes personal data, so we enabled the IP masking feature of Statcounter on 22 May 2018. This means that only the group of 255 internet addresses that our visitors arrive from will be recorded from this date onward., e.g. if your IP is 123.45.67.89, then we only record 123.45.67. We have also made technical changes to implement the same IP masking in Google Analytics as is offered by Statcounter. We therefore avail ourselves of the protections of Recital 26 - i.e. the GDPR does not apply to our collection of statistical data because it contains no personal identifiers.
4) Google has a global presence and does not indicate where its data is physically stored. Instead it makes assurances in its Data Safeguarding statement.
5) Our use of Google Analytics from May 25th 2018 is set to use the minimum data retention period that Google currently offers - 14 months without reset. In addition, we do not enable features such as Display and Search Remarketing.
6) Recital 73 states that Subject access rights can properly be overridden in the specific case of the prevention, investigation and prosecution of criminal offences, e.g. matters under the Computer Misuse Act 1990. Recital 49 further establishes a specific overriding legitimate interest in processing personal data for the protection of the information system itself.
If a website visitor chooses to fill in a contact or booking form and supply personal data, that form data is immediately transmitted via e-mail to our admin systems; it is not stored on the website after form submission.
We have a separate page that details our use of cookies.
If you are a recipient of our occasional newsletter e-mails
We have an e-mail address - nothing else. This data is stored with other newsletter recipients in a mailing dataset that is used solely for sending our newsletters. We process data about your e-mail address solely to ensure that the subscriber list only contains valid e-mail addresses (MX domain lookups and RFC3834 return-path messages) of people in business who wish to receive the newsletter. We do not send out versions of our newsletter - every recipient receives the same newsletter (apart from the pseudonymised unsubscribe link) . We believe that this means that we are regulated under the PECR B2B rules. This data resides in the United Kingdom at rest in a secure managed server hosting facility and protected in transit by end-to-end strong encryption.
Disclosure of information to third parties
We would only ever disclose information to unconnected third parties if the law says that we must. A connected party is any person instructed by the data controller to be a data processor.
West Thames College is a training provider for the Logistics Skills Alliance and your training enquiries will be handled by their staff members. West Thames' use of the data you provide is governed by their own policies.
Our duty to keep records of data processing
Article 30 Paragraph 5 of the GDPR states
The obligations referred to in paragraphs 1 and 2 [record keeping duties] shall not apply to an enterprise or an organisation employing fewer than 250 persons unless [...] the processing is not occasional [...]
Recital 13 Point 3 of the GDPR states
To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.
The Logistics Skills Alliance has fewer than 250 employees and does not send newsletters regularly, neither is it part of the regular course of activity of the data controller. Our processing of the e-mails is therefore occasional, as defined by the Position Paper dated April 19 2018 on Article 30 published by the Article 29 Working Party (WP29).
How do I find out what you know about me and get it changed ?
If, having read the above, you can reasonably conclude that we hold personal data about you, you can contact us in writing at the following address to ask what information we may hold about you.
Logistics Skills Alliance
77 Boundaries Road
Feltham
TW13 5DR
Please mark your correspondence GDPR Subject Data Request (Logistics Skills Alliance)
Please include with your application sufficient proof of identity to allow us to determine to an adequate legal standard that you are the subject of the data request - you cannot make an application on behalf of anyone other than yourself unless you can demonstrate that you have been properly authorised to do so. The Government has determined here that these are adequate levels of documentation - please see the section titled 'Proof of identity checklist for individuals'. We always require proof of identity, otherwise we risk being in violation of our duty to not disclose personal data to unconnected third parties.
You should indicate in your application the list of access rights and remedies that you are seeking under the Data Protection Act 2018 and provide full and accurate information to allow us to process your claim efficiently. Information about how to write a meaningful subject data request is widely available, e.g. here
It is not acceptable to make multiple requests of a repetitive nature. The ICO guidelines give us a right to refuse to comply with any request that is "manifestly unfounded or excessive, taking into account whether the request is repetitive in nature."
In such cases we will charge you the permissable administrative fee that the law says we can in order to process your request. We do this for the following reasons
To deter manifestly unfounded, excessive or otherwise vexatious enquiries
To pay for the time and resources involved in processing your enquiry
If we believe the claim to be manifestly unfounded or excessive, we will normally contact you to advise you of this and justify our reasons for reaching this conclusion. We will then either refuse to process the request or tell you what the administrative fee will be to begin processing your request.
If we do hold information about you, you can ask for it to be deleted and we will comply if the law says we must do so, otherwise we will normally comply if the law says we can do so, with the following exceptions (this list may change)
accurate published public-domain journalistic reportage - you do not have the right of censorship.
if the deletion would prevent the delivery of or payment for services to you that we have entered into a contract to provide
if we otherwise have a legitimate interest in the retention of the data, e.g. we will record the fact of each request and will not normally delete such data.
You can also ask for your data to be amended (without exception) if it is factually inaccurate and we will either correct or remove the information in question.
Nothing in the above removes any of your rights under UK law, or the rights of the Logistics Skills Alliance.
