Data & Privacy Policy

Dream Awake China Ltd.

Introduction

It is DAC’s policy to ensure that all personal data held by us is handled correctly and appropriately according to the nature of the information, the risk associated with mishandling the data, including the damage that could be caused to an individual because of loss, corruption and/or accidental disclosure of any such data, and in accordance with any applicable legal requirements. There are six data protection principles defined by UK GDPR. These require that all personal data be:

Processed in a lawful, fair and transparent manner
Collected only for specific, explicit and limited purposes (“purpose limitation”)
Adequate, relevant and not excessive (“data minimisation”)
Accurate and kept up to date where necessary
Kept for no longer than necessary (“retention”)
Handled with appropriate security and confidentiality

Every member of staff has a responsibility to adhere to the Data Protection Principles outlined in UK GDPR, and to this Data Protection Policy.

Data Protection

Data Protection Officer

Although we are not legally required to have a Data Protection Officer, DAC has opted to assign this role to the Producer to demonstrate our accountability and ensure our compliance with data protection requirements. Their role is to:

Oversee the process and procedures for collecting and handling personal data
Inform and advise the company and its employees of their responsibilities in complying with data protection law and this policy
Maintain and review the Data Processing Register
Act as a contact point for data subjects and the Information Commissioner’s Office

Although DAC has identified the Producer as the Data Protection Officer, this does not preclude other responsible members of staff from carrying out these duties.

Lawful Processing

To collect and process personal data, it is essential to meet one of the six lawful bases for processing as defined by UK GDPR. In summary, DAC can process personal data if:

We have the consent of the data subject
It is in our legitimate interest and this is not overridden by the rights and freedoms of the data subject
It is necessary to meet a legal obligation
It is necessary to fulfil a contract or pre-contractual obligations
We are protecting someone’s vital interests
We are fulfilling a public task or acting under official authority

For each data processing task, the most appropriate lawful basis to collect data will be recorded in the Data Processing Register.

Special Category Data

Under UK GDPR there are specific rules for collecting and processing Special Category Data, which is defined as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sexual orientation.

Ordinarily, collection of this data is prohibited, but there are certain circumstances under UK GDPR when the data can be collected. For example, DAC could:

Collect health data to make decisions around access to ensure that employees can attend work or participants can take part in an activity
Collect racial, ethnic or sexual orientation data to understand the diversity of its employees, audiences or trustees

DAC will only collect Special Category Data if:

There is a lawful basis to collect the data
Collection of the data adheres to the six principles of data collection
The Producer as DPO has been contacted in advance to discuss the basis and process of collection
The decision and process to collect this data have been recorded in the Data Processing Register
Collection of the data is optional for the data subject
The DPO is the only person who has access to the raw data or any data that could be personally identifiable

On collection of data, the DPO will collate and anonymise the data for distribution to core staff if necessary and/or others if appropriate. However, this data will only be issued if, after collation and anonymisation, no individual person can still be identified. If this is not possible, then the data will not be released.

Consent

Where processing is based on consent, DAC will ensure that the data subject has the option to easily withdraw their consent should they choose to do so, and this choice will be recognised and adhered to by us. This includes:

Detailing on our website how to withdraw consent within our Privacy Notice
Including opt-out links in all our e-newsletters and electronic marketing
Making the sign-up to our e-newsletters a two-stage process

Data Minimisation, Control and Retention

In keeping with the six principles of data protection:

The DPO will regularly review our data collection processes to ensure that personal data collected and processed is kept to a minimum
We will keep the personal data that we collect, use and share to the minimum amount required to be adequate for its purpose
Where we do not have a legal obligation to retain some personal data, we will consider whether there is a business need to hold it
We will retain personal data only for as long as is necessary to meet its purpose
Our approach to retaining and erasing data no longer required will be specified in the Data Processing Register, which will be reviewed annually by the Trustees
Data will be purged on an annual basis at the start of March
When sharing personal data internally or with any third party, only the data that is necessary will be disclosed, with data collated or anonymised if possible

Rights of Data Subjects

Under data protection laws, data subjects have certain rights, including:

Right to be informed: the right to be told how their personal data is used in clear and transparent language
Right of access: the right to know and have access to the personal data we hold about them
Right to data portability: the right to receive their data in a common and machine-readable electronic format
Right to be forgotten: the right to have their personal data erased
Right to rectification: the right to have their personal data corrected where it is inaccurate or incomplete
Right to object: the right to complain and to object to processing
Right to purpose limitation: the right to limit the extent of the processing of their personal data
Rights related to automated decision-making and profiling: the right not to be subject to decisions without human involvement

DAC will uphold individuals’ rights under data protection laws and allow them to exercise their rights over the personal data we hold about them. Most rights are not absolute, and individuals will be able to exercise them depending on the circumstances, and exemptions may apply in some cases.

A Privacy Notice published on our website details the data subject’s rights and explains the process for contacting DAC and the procedures the company will follow should a subject exercise their rights. In summary these include:

Asking the data subject to contact the company in writing via info@dreamawake.uk
Asking individuals to prove their identity where it is not obvious that they are the data subject
Responding to their request within one month from the date of the request or the date we are able to identify the person
Responding within one month to advise of an estimated response time if the request is particularly complex

All contacts invoking data subject rights will be forwarded to the DPO, who will assess the request and oversee any procedures for responding where necessary. All requests and responses will be recorded in the Data Processing Register by the DPO.

There is no fee for facilitating a request unless it is “manifestly unfounded or excessive”, in which case administrative costs can be recovered. Requests that are “manifestly unfounded or excessive” can be refused.

Third Party and Cloud Based Data Processors

DAC uses a variety of cloud-based applications and third-party data processors including:

Xero: finance processing and payroll
WordPress: website hosting
Google Workspace: applications and data storage
NordLocker: secure encrypted storage

To ensure we remain compliant in terms of data storage, handling and processing, DAC will only appoint platforms that can provide sufficient guarantees around compliance with UK GDPR and that the rights of data subjects will be protected. We will also seek to engage with platforms that can demonstrate adherence to approved codes of conduct or certification schemes such as ISO/IEC 27001:2013 or Payment Card Industry Data Security Standard (PCI-DSS).

Additionally, where possible, we will seek to appoint platforms that provide two-factor authentication and individual logins rather than shared logins, enhancing our security provision and reducing the risk of any data breach.

Data Breaches

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Data breaches can result in severe fines for the company from the Information Commissioner’s Office, a loss of reputation and, perhaps more importantly, stress and anxiety for those who have had their data compromised. Therefore, all staff, freelancers and trustees should be vigilant and able to identify a suspected personal data breach, which could include:

Loss or theft of devices or data, including information stored on USB drives or on paper
Hacking or other forms of unauthorised access to a device, email account or the network
Disclosing personal data to the wrong person through wrongly addressed emails or bulk emails that inappropriately reveal all recipients’ email addresses
Alteration or destruction of personal data without permission

On identification of a data breach:

The DPO will be informed as soon as possible
The DPO will report the personal data breach to the ICO within 72 hours of DAC being aware of the breach if there is a likely risk to individuals’ rights and freedoms
DAC will inform individuals directly affected and without delay if there is also a likely high risk to individuals’ rights and freedoms
The DPO will record data breaches in the Data Processing Register, updating processes and procedures as required to reduce the risk of recurrence