OTWT Data Protection Policy

As part of our operations, we need to obtain and process information. This information includes any offline or online data that makes a person identifiable such as names, addresses, email addresses Our company collects this information in a transparent way and only with the full cooperation and knowledge of our customers. Once this information is available to us, the following rules apply.

Our data will be:

Accurate and kept up-to-date

Collected fairly and for lawful purposes only

Processed by the OTWT within its legal and moral boundaries

Protected against any unauthorised or illegal access by internal or external parties

Our data will not be:

Communicated informally

Stored for more than a specified amount of time

Transferred to other organisations that do not have adequate data protection policies

Distributed to any party other than the ones agreed upon by the data’s owner.

In addition to ways of handling the data the OTWT has direct obligations towards people to whom the data belongs. Specifically we must: · Let people know which of their data is collected

Inform people about how we’ll process their data · Inform people about who has access to their information

Have provisions in cases of lost, corrupted or compromised data

Allow people to request that we modify, erase, reduce or correct data contained in our databases


To exercise data protection we’re committed to: · Restrict and monitor access to sensitive data

Develop transparent data collection procedures

Train employees in online privacy and security measures

Build secure networks to protect online data from cyberattacks

Establish clear procedures for reporting privacy breaches or data misuse

Include contract clauses or communicate statements on how we handle data

Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorisation etc.)

Data processing activities

Email Addresses/telephone number to confirm order and contact a customer >Written down on an order form > filed away in a Diary > Taken to the kitchen to process order > File order form for a maximum of a month > Shredded at source

  • Bank Card details to take payment over the phone >Written down on an order form to take payment once a phone call has ended > order form filed for a maximum of a month > Shredded at source

Staff Sort code and Account numbers to process payroll > Processed by 10CA. Secure and can be deleted by user at any time.

Staff Personal Information for Accountant > National insurance, bank details to be held by 10CA

Website Traffic Information

Volume of people visited

What pages they clicked on

Communicate fair processing notices/privacy notices

All staff to inform customers and staff of where and how their personal data will be used and how long for and when it will be deleted or destroyed.

What area they’re from.

Training and awareness

Monthly review of staff knowledge and Data Protection policy. Ensuring staff have an understanding of their rights and the rights of others.

Data breach reporting

Ensuring all data breaches are reported to the Information Commissioner’s Office –

0303 123 1113

Review ICO/DPC website

Employers at OTWT to have access to : ico.org.uk – Information Commissioner’s Office