Privacy Statement
At EverydayNFW we are committed to protecting your privacy. We comply with the principles of GDPR and aim to maintain consistently high levels of best practice in our processing of personal and/or sensitive personal data.
1 Introduction
1.1 Purpose of Policy
Everyday Nutrition Fitness and Wellbeing (T/A Nutrition4living,Everyday NFW, Vigour) needs to gather and use certain information about individuals.
These can include clients, suppliers, employees and other people the organisation has a relationship with or may need to contact.
This policy describes how this personal data will be collected, handled and stored to comply with the General Data Protection Regulation.
1.2 Policy Statement
Everyday Nutrition Fitness and Wellbeing is committed to a policy of protecting the rights and privacy of clients, staff and others in accordance with General Data Protection Regulation.
Everyday Nutrition Fitness and Wellbeing commits to:
comply with both the law and good practice
respect individuals’ rights
be open and honest with individuals whose data is held
provide training and support to staff who handle personal data, so that they can act confidently and consistently
1.3 Personal Data
Everyday Nutrition Fitness and Wellbeing may hold data for the following purposes:
Provision of direct healthcare
Marketing and newsletters
Case histories
Staff Administration
Special categories of data included race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health and sexual orientation.
Before you provide any data to us we will endeavour to make it clear why we need it. When this is required we will obtain your consent first. Otherwise, by providing us with information, either orally or written, or by using our website, you consent to the collection, use and processing of this information by Everyday NFW to provide and send you information about their services.
Everyday Nutrition Fitness and Wellbeing may hold special category data for the following purposes:
Provision of direct healthcare
We may ask for your home, work, mobile telephone number, and email address to enable us to contact you in relation to an enquiry you have made, to contact you about relevant products or services which we offer, to contact you if there is a problem with your order, or there is another genuine reason for doing so. If you provide us with credit or debit card details in order to pay for a service or product, we will keep such details secure and ensure that the details are only used further with your consent and/or for the purposes of any appropriate refunds.
1.4 Data Protection Principles
There are six data protection principles that are core to the General Data Protection Regulation. Everyday Nutrition Fitness and Wellbeing will make every possible effort to comply with these principles at all times in our information-handling practices. The principles are:
Lawful, fair and transparent
Data collection must be fair, for a legal purpose and we must be open and transparent as to how the data will be used.
Limited for its purpose
Data can only be collected for a specific purpose.
Data minimisation
Any data collected must be necessary and not excessive for its purpose.
Accurate
The data we hold must be accurate and kept up to date.
Retention
We cannot store data longer than necessary.
Integrity and confidentiality
The data we hold must be kept safe and secure.
1.5 Key risks
The main risks are in two key areas:
information about individuals getting into the wrong hands, through poor security or inappropriate disclosure of information
individuals being harmed through data being inaccurate or insufficient
2 Responsibilities
Niall O’Callaghan is the data controller for all personal data held by us and is responsible for:
Analysing and documenting the type of personal data we hold
Checking procedures to ensure they cover all the rights of the individual
Identifying the lawful basis for processing data
Ensuring consent procedures are lawful
Implementing and reviewing procedures to detect, report and investigate personal data breaches
Storing data in safe and secure ways
Assessing the risk that could be posed to individual rights and freedoms should data be compromised
3 Data Recording, Security and Storage
3.1 Data accuracy and relevance
Everyday Nutrition Fitness and Wellbeing will ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purpose for which it was obtained. We process your personal data in order to provide you with our services and to assist you in the services we provide.
3.2 Data security
Everyday Nutrition Fitness and Wellbeing will keep personal data secure against loss or misuse.
We store all the information you provide us, including information provided via forms you complete on our website, and information which we may collect from your browsing. Our server, in common with nearly all web servers, logs each page that is downloaded from the site.
Any new information you provide us may be used to update an existing record we hold for you. If you provide a work email address we will not be responsible for third parties having access to any communications we send.
3.3 Storing data securely
In cases when data is stored on printed paper, it will be kept in a secure place where unauthorised personnel cannot access it
Printed data will be shredded when it is no longer needed
Data stored on a computer will be protected by strong passwords that are changed regularly.
Data stored on CDs or memory sticks will be encrypted or password protected and locked away securely when they are not being used
Cloud services used to store personal data will be assessed for compliance with GDPR principles.
Servers containing personal data must be kept in a secure location, away from general office space
Data will be regularly backed up.
All servers containing sensitive data must be protected by security software
All possible technical measures will be put in place to keep data secure
3.4 Data retention
Everyday Nutrition Fitness and Wellbeing will retain personal data for no longer than is necessary. This shall be in accordance with the guidelines of relevant professional associations.
If you contact us electronically we may collect your electronic identifier, eg Internet protocol (IP) address or phone number supplied by your service provider. This is to identify any repeat website visits, fraudulent behaviour or mystery shoppers using our websites.
4 Accountability and Transparency
Everyday Nutrition Fitness and Wellbeing will ensure accountability and transparency in all our use of personal data. We will keep written up-to-date records of all the data processing activities that we do and ensure that they comply with each of the GDPR principles.
5 Consent
Everyday Nutrition Fitness and Wellbeing will ensure that consents are specific, informed and plain English such that individuals clearly understand why their information will be collected, who it will be shared with, and the possible consequences of them agreeing or refusing the proposed use of the data. Consents will be granular to provide choice as to which data will be collected and for what purpose. We will seek explicit consent wherever possible.
We will maintain an audit trail of consent by documenting details of consent received including who consented, when, how, what, if and when they withdraw consent. Alternatively we will maintain the consents information in a spreadsheet with links to the consent forms.
We will regularly review consents and seek to refresh them regularly or if anything changes.
6 Direct Marketing
If you consent to us sending you marketing messages about our products and services we will process your personal data in order to make sure that any marketing messages that we send you are relevant to you. With your permission, this may include processing your health data to identify services that might be particularly relevant to you.
When you enter a contest or other promotional feature, we may ask for your name, address, phone numbers and email address so we can administer the contest and notify winners. Occasionally, we may also use the information we collect to notify you by post, phone, mobile phone, email and SMS about new or existing Synergy services, products and special offers we think you'll find valuable.
We may use sensitive personal data collected in respect of one product to market another appropriate product to you.
Opt Out
Each time you receive marketing information or a message, you have the option to decline to receive further marketing information from us. This is known as an "opt-out". If you wish to exercise the opt-out, write to The Data Protection Officer, EverydayNFW, 73 The Green, Coolroe Meadows, Ballincollig, Co. Cork. email us at niall@everydaynfw.com or telephone us at +353 21 486 0434. If you have more than one address or email address please make sure to notify any changes to your preferences for each address or email address you have registered with us.
If you have more than one address or email address please make sure to notify any changes to your preferences for each address or email address you have registered with us.
7 Subject Access Requests
7.1 What is a subject access request?
An individual has the right to receive confirmation that their data is being processed, access to their personal data and supplementary information which means the information which should be provided in a privacy notice.
7.2 How to deal with subject access requests
Everyday Nutrition Fitness and Wellbeing will provide an individual with a copy of the information requested, free of charge. This will occur within one month of receipt. We endeavour to provide data subjects access to their information in commonly used electronic formats (as described in section 4.3).
If complying with the request is complex or numerous, the deadline can be extended by two months, but the individual will be informed within one month.
We can refuse to respond to certain requests, and can, in circumstances of the request being manifestly unfounded or excessive, charge a fee. If the request is for a large quantity of data, we can request the individual specify the information they are requesting.
Once a subject access request has been made, we will not change or amend any of the data that has been requested. Doing so is a criminal offence.
7.3 Data portability requests
We will provide the data requested in a structured, commonly used and machine-readable format. This would normally be a PDF file, although other formats are acceptable. We must provide this data either to the individual who has requested it, or to the data controller they have requested it be sent to within one month.
8 Transferring data internationally
There are restrictions on international transfers of personal data. We will not transfer personal data abroad without express consent.
9 Third Parties
9.1 Using third party controllers and processors
As a data controller, we will only appoint processors who can provide sufficient guarantees under GDPR and that the rights of data subjects will be respected and protected.
As a data processor, we will only act on the documented instructions of a controller. We acknowledge our responsibilities as a data processor under GDPR and we will protect and respect the rights of data subjects.
Third parties may deliver some of our products to you or provide all or part of the service requested by you. In these instances, whilst the information you provide will be disclosed to them, it will only be used for the administration of the service provided, pricing purposes as appropriate, testing, and to maintain management information for business analysis.
9.2 Contracts
Our contracts will comply with the standards set out by the Data Protection Commissioner and, where possible, follow standard contractual clauses. Our contracts with data controllers (and/or) data processors will set out the subject matter and duration of the processing, the nature and stated purpose of the processing activities, the types of personal data and categories of data subject, and the obligations and rights of the controller.
10 Reporting breaches
Any breach of this policy or of data protection laws will be reported as soon as practically possible. This means as soon as we become aware of a breach.
Everyday Nutrition Fitness and Wellbeing has a legal obligation to report any data breaches to Data Protection Commissioner.
11 Changes to our privacy policy
If we decide to change our privacy policy, we will update all relevant documentation and post any changes on our websites so that you are always aware of what information we collect, how we use it, and under what circumstances we disclose it.
12 Social Media Plug-Ins
Our website has 2 plug-ins: Twitter and LinkedIn. These plug-ins remain inactive until clicked upon. Once clicked upon, the individual will be taken to the social media network each of which have their own specific privacy policies which we recommend users consult.
13 Web browser cookies
Our site may use “cookies” to enhance the user experience. Cookies are small text files that act as an identification card and they cannot be executed as code or deliver viruses. The use of cookies is an industry standard, their purpose merely being to record that you have visited or returned to that web page. Through cookies, EverydayNFW does not collect additional information such as age, gender, interests or bank details.
14 Events and Photography
At events organised by EverydayNFW, delegates/attendees will be advised if/when there will be photography, video recording or livestreaming.
These materials may be used by EverydayNFW and included in publications, media materials, promotional materials, digital platforms and social platforms.
If delegates/attendees do not wish to appear in any images captured or recordings, they are advised to contact EverydayNFW who can then take appropriate steps to comply with their wishes.
EverydayNFW does not provide contact details, such as phone/email number, of individuals on the delegate/attendee list at events.
