1. Policy Statement
   • Everyone has rights regarding the way in which their personal data is handled. During the course of our activities, we will collect, store and process personal data about our customers, suppliers and other third parties, and we recognise that the correct and lawful treatment of this data will maintain confidence in the organisation and will provide for successful business operations.
   • Data users are obliged to comply with this policy when processing personal data on our behalf. Any breach of this policy may result in disciplinary action.

2. About this Policy
   • It is the Policy of Fifth Gear Transport Services Limited to comply with the Data Protection Act 2018 (DPA), UK GDPR and good practice at all times.
   • This policy sets out the basis on which we will process any personal data we collect from data subjects, or that is provided to us by data subjects or other sources.
   • The Data Protection Compliance Manager is responsible for ensuring compliance with the Act and with this policy. That post is held by Rob Eves. Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Data Protection Compliance Manager.

3. Definition of Data Protection Terms
   • Datais information, which is stored electronically, on a computer, or in certain paper-based filing systems.
   • Data subjectsfor the purpose of this policy include all living individuals about whom we hold personal data. A data subject need not be a UK national or resident. All data subjects have legal rights in relation to their personal information.
   • Personal datameans data relating to a living individual who can be identified from that data (or from that data and other information in our possession). Personal data can be factual (for example, a name, address, or date of birth) or it can be an opinion about that person, their actions and behaviour.
   • Data controllersare the people who or organisations which determine the purposes for which, and the manner in which, any personal data is processed. They are responsible for establishing practices and policies in line with the Act. We are the data controller of all personal data used in our business for our own commercial purposes.
   • Data usersare those of our employees whose work involves processing personal data. Data users must protect the data they handle in accordance with this data protection policy and any applicable data security procedures at all times.
   • Data processorsinclude any person or organisation that is not a data user that processes personal data on our behalf and on our instructions. Employees of data controllers are excluded from this definition, but it could include suppliers which handle personal data on Fifth Gear Transport Services Limited’s behalf.
   • Processingis any activity that involves use of the data. It includes obtaining, recording, or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing, or destroying it. Processing also includes transferring personal data to third parties.

4. Procedures for data processing
   • Fifth Gear Transport Services Limited has registered with the Information Commissioner’s Office for data protection.
   • The “PIMs” procedures for data processing which includes the identification of all external and internal stakeholders; individuals with responsibility within the “PIMs system” with controls to ensure that the minimum personal data collection and processing is adequate, secure, strictly necessary, not excessive for the specific purpose and is:

• Processed fairly, lawfully and retained securely and only as long as is necessary.
• Processed for limited purposes and in an appropriate way.
• Not kept for longer than the necessary purpose.
• Not transferred to people or organisations situated in countries without adequate protections.
• Processed in line with the data subjects' rights.
• In connection with any legal proceedings or for the purpose of obtaining legal advice.
• For the administration of justice, for the exercise of functions conferred by statute, or for the exercise of any function of the Crown.
• Data for the purpose of monitoring equality is carried out with appropriate safeguards for the rights and freedoms of data subjects and that information is accurate, and where necessary kept secure and up to date.
• Respectful of individual data subjects’ rights in relation to their personal information, including their right to access information held on written request to the “Data Controller” at Fifth Gear Transport Services Limited Head Office; and
• Where CCTV recording is in place, the monitoring, replaying, and reviewing of data for the purposes of monitoring security, wellbeing and safety for employees including the public.

5. Communication and Consent
   • This policy is communicated to all existing and potential employees and “other” individuals who provide information for the purposes of access control.
   • Personal data of employees, prospective employees and subcontractors is used as part of Fifth Gear Transport Services Limited’s security, safety, and welfare access control systems.
   • Explicit consent is obtained from all individuals providing personal data for specified use which includes clear purpose and methods of how the processing and storage stated at the time of information request.
   • Fifth Gear Transport Services Limited will not transfer data outside the European Economic Community unless it has been confirmed that it can be adequately protected, and explicit permission has been obtained from the Data Subject.
   • Data provided by individuals, Fifth Gear Transport Services Limited employees including subcontractors regarding their qualification and competence is used for validity checks of expiry dates for licence and related scheme cards including. Where personal data is collected for the; all such “personal data” in hard copy and or electronic form will be held securely under lock and key, and as applicable password protected computer systems. Any person requesting sight of such information must have written authority from the authorised “Data Processor”; for clarity this will be the Fifth Gear Transport Services Limited Compliance Manager.

6. Security
   • We have in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data will only be transferred to a data processor if he agrees to comply with those procedures and policies, or if he puts in place adequate measures himself.
   • Security procedures include:
     • Secure lockable desks and cupboards.Desks and cupboards should be kept locked if they hold confidential information of any kind. (Personal information is always considered confidential.)
     • Methods of disposal.Paper documents should be shredded. Digital storage devices should be physically destroyed when they are no longer required.
     • Data users must ensure that individual monitors do not show confidential information to passers-by and that they log off from their PC when it is left unattended.

7. Disclosure and Sharing of Personal Information
   • We may share personal data we hold with any member of our group, which means our subsidiaries, our ultimate holding company, and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.
   • We may also disclose personal data we hold to third parties:
     • In the event that we sell or buy any business or assets, in which case we may disclose personal data we hold to the prospective seller or buyer of such business or assets.
     • If we or substantially all of our assets are acquired by a third party, in which case personal data we hold will be one of the transferred assets.
     • If we are under a duty to disclose or share a data subject's personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the data subject or other agreements; or to protect our rights, property, or safety of our employees, customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

8. Dealing with Subject Access Requests
   • Data subjects must make a formal request for information we hold about them. This must be made in writing. Employees who receive a written request should forward it to the Data Protection Compliance Manager immediately.
   • When receiving telephone enquiries, we will only disclose personal data we hold on our systems if the following conditions are met:
     • We will check the caller's identity to make sure that information is only given to a person who is entitled to it.
     • We will suggest that the caller put their request in writing if we are not sure about the caller’s identity and where their identity cannot be checked.
     • Our employees will refer a request to the Data Protection Compliance Manager for assistance in difficult situations. Employees should not be bullied into disclosing personal information.

This policy applies to all employees of Fifth Gear Transport Services Limited.