We use analytics to see which pages are useful. If you accept, we load Google Analytics — which sets cookies — and Plausible, which is anonymous and cookieless. Privacy notice

Home/Data Protection Policy

Data Protection Policy

Omnia Smart Technologies Limited

← Back to Home

Data Protection Policy

The purpose of this policy is to set out how Omnia Smart Technologies Limited ("Omnia") ensures compliance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and related legislation ("data protection law"). Data protection law applies to the storing or handling ("processing") of information ("personal data") about living identifiable individuals ("data subjects").

Data Protection Principles

Omnia, as Controller and in cases Processor, must be able to demonstrate compliance with data protection law. This policy outlines Omnia's compliance with Article 5 of the UK GDPR and Data Protection Principles in that data shall be:

  • Processed lawfully, fairly and in a transparent manner
  • Collected for specified, explicit and legitimate purposes
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
  • Accurate and, where necessary, kept up to date
  • Kept for no longer than is necessary for the purposes for which the personal data are processed
  • Processed in a manner that ensures appropriate security

Omnia will ensure that all personal data will comply with the above principles and ensure it satisfies one of the lawful grounds for processing set out below.

Processing Data Lawfully

Omnia will ensure that it has a "lawful basis" or "grounds for processing" before legally processing personal data. There are six different grounds for processing:

  • Consent – the individual/data subject has freely given their consent to the processing and data must be collected through a clear affirmative action
  • Contractual – processing is necessary for the performance of a contract or agreement to which the individual is party or is required prior to entering into a contract
  • Legal Requirement – processing is necessary for compliance with a legal obligation to which the individual is subject
  • Public Interest – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • Legitimate Interests – processing is necessary for the purposes of the legitimate interests of the organisation or a third party where the interest and rights and freedoms of the individual are not overridden, and the data is used in ways which people would reasonably expect
  • Vital Interests – processing is necessary to protect the vital interests of the individual or of another person

Legitimate Purpose

Omnia will ensure that personal data collected is necessary for processing and not further processed in a manner that is incompatible with those purposes. Omnia will communicate in a clear and transparent manner ensuring that all data subjects are informed of the purpose for their data being processed and only use their personal data in a way that the data subject expects and in accordance with their rights.

Adequacy and Relevance

Omnia will ensure that the data processed will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, and those purposes will be transparent and clear. If intentions are to use the data for any other purpose, data subjects are informed and have the right to object.

Retention Periods

Omnia will not store data for any time longer than necessary or if the data subject withdraws consent or objects to its processing (unless there is another legal ground to justify its retention). When personal data is no longer needed for the purposes for which it was collected, this personal data should be securely destroyed as soon as practicable.

Data Security

Omnia depends on information and communications technology systems to operate its business and administrative functions. Security of these systems, the hardware and networks on which they reside and the data which they host is necessary both to honour Omnia's obligations to providers of data (employees, suppliers, customers and sub-contractors) as required under UK GDPR (Articles 25 and 32) and to protect Omnia's systems and data from damage, loss or corruption whether accidental or deliberate.

Omnia employs best practice measures to ensure data security within its business, including the use of strong passwords and encryption. Data is backed up in line with Omnia's backup procedures. All servers and PCs containing sensitive data are protected by security software.

International Transfers

Omnia will only transfer personal data outside the UK where it is satisfied that the third country or territory to which the data is being transferred is subject to an adequate level of protection (whether through an adequacy decision or the implementation of appropriate safeguards) and enforceable data subject rights and effective legal remedies for data subjects are available.

Disclosure to Third Parties

  • Due diligence – Omnia will select a third-party supplier who provides sufficient guarantees with respect to data security and the handling of personal data generally.
  • Contractual obligations – Omnia will ensure that there is a written contract in place with any third-party supplier which includes specific data privacy obligations protecting personal data (including the mandatory data processor terms from Article 28 of UK GDPR).
  • Information and audit – Omnia will take steps to monitor any third-party's compliance with its contractual and legal commitments in relation to data protection law.
  • International transfers – If engaging a third-party involving personal data being processed outside the United Kingdom, additional contractual safeguards will be put in place.

Upholding Individual Rights and Freedoms

Individuals have the following legal rights in relation to their personal data:

  • Right to be informed – Omnia will give individuals specific information about how it processes their personal data.
  • Right of access – Individuals are entitled to receive confirmation as to whether Omnia is processing personal data about them and, if so, to access it.
  • Right to rectification – Individuals can require Omnia to correct any inaccuracies without undue delay.
  • Right to erasure – Individuals can require Omnia to erase their personal data, without undue delay, in certain circumstances.
  • Right to restrict processing – Individuals can require Omnia to restrict processing in certain circumstances.
  • Right to data portability – Individuals can, in certain circumstances, receive personal data in a structured, commonly used and machine-readable format.
  • Right to object – Individuals have the right to object to processing where Omnia's lawful basis is legitimate interests or where Omnia directly markets to them.
  • Rights related to automated decision making – Individuals can object to decisions based solely on automated processing.
  • Right to withdraw consent – Individuals have the right to withdraw their consent to Omnia's processing of their personal data at any time.

Data Breach Management

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. UK GDPR requires that a breach must be reported to the Information Commissioner's Office ("ICO") unless the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals. The timeframe for reporting to the ICO is without undue delay and, where feasible, not later than 72 hours after having become aware of the breach.

Data Protection Impact Assessments

A Data Protection Impact Assessment ("DPIA") is a methodology or tool used to identify and reduce the privacy risks of individuals when planning projects or policies that involve the processing of personal data. Omnia manages all new data assessments through its DPIA management process which is based upon the ICO template and guidance, adapted to suit each project.

Privacy by Design and by Default

Omnia has a general obligation to implement technical and organisational measures to show that it has considered and integrated data protection into its personal data processing activities. Omnia will implement appropriate technical and organisational measures to ensure that, by default, it only processes personal data which is necessary for each specific purpose of the processing.

Training

Omnia will ensure that training and information will be made available to all its employees and sub-contractors in relation to compliance with data protection law, updated and refreshed on a regular basis.

Governance

Omnia's MD on behalf of the Omnia Board acts as its data protection officer and is responsible for overseeing changes to systems and processes, monitoring compliance with UK GDPR and the Data Protection Act 2018, completing DPIAs, and liaising with the ICO if required.

Review

Omnia will regularly test the privacy measures implemented and conduct periodic reviews and audits to assess compliance. This Policy will be reviewed by Omnia's MD and board of directors on a regular basis (at least annually) and may be amended from time to time.