Go Auction Ltd. (referred to as “we”, “us” or “our” in this Policy document) is committed to protecting the rights and freedoms of data subjects and safely and securely processing their data in accordance with all our legal obligations under GDPR (General Data Protection Legislation). This Policy provides you with details of how we collect and process personal data when you use one or more of our services, or when you otherwise engage with us, including, but not limited to:
In the context of the services Go Auction provide to auctioneers (our Go Web and Go Office products), Go Auction are a ‘data processor’. This means that we must implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the GDPR regulation and ensure the protection of the rights of the data subject. In the context of the data we hold on our clients (i.e. auctioneers who we are working with), Go Auction Ltd is a data controller.
Our Data Protection Officer is Nikki Robinson – who is contactable at email@example.com, telephone 0161 513 4000, Go Auction Ltd. Nantwich Court, Hospital Street, Nantwich, CW5 5RH.
It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at firstname.lastname@example.org.
1.1 The principles
Go Auction Ltd. shall comply with the principles of data protection (the Principles) enumerated in the EU General Data Protection Regulation (‘GDPR’). We will make every effort possible in everything we do to comply with these principles. The Principles are:
In this document we will show how we comply with each Principle, in particular, we will document how we will:
1.2 Lawful basis for processing data
We must establish a lawful basis for processing data. It is your responsibility to check the lawful basis for any data you are working with and ensure all your actions comply the lawful basis. At least one of the following conditions must apply whenever we process personal data on your behalf:
1.3 The conditions we rely on
In making any assessment of the lawful basis, we have determined that the processing is necessary, and also a targeted, appropriate way of achieving the stated purpose, and there is no other means by which we can reasonably achieve the same result. This is in accordance with points 1 and 2 in the above list.
Our commitment to the first Principle requires us to show that we have considered which lawful basis best applies to each processing purpose, and be able to fully justify these decisions. The conditions we rely on for the specific data we collect are outlined in section 2.1, below.
1.4 Your use of the software we provide
Go Auction Ltd. provides software and services to auctioneers; whilst we make every effort to process data in accordance with the conditions above, it is the responsibility of the data controller to use the software in the way it is intended and within the scope of the GDPR and other applicable privacy laws. If you use our software in a way that is not in accordance with these laws, this is not the responsibility of Go Auction Ltd. as the data processor, and you as the data controller take full responsibility for your actions.
This Policy applies to all Go Auction staff and associates, who must be familiar with this Policy and comply with its terms. It sets out how we seek to protect personal data and ensure that our staff understand the rules governing their use of data to which they have access in the course of their work. In particular, this Policy requires staff to ensure that the Data Protection Officer (DPO) be consulted before any significant new data processing activity is initiated to ensure that relevant compliance steps are addressed.
We may supplement or amend this Policy from time to time; changes will be circulated to staff and our clients, as well as being updated on our website.
2.1 What we collect and why we collect it
Personal data means any information capable of identifying an individual. It does not include anonymised data. We primarily collect personal information that is necessary for us to provide our services to clients. We will also collect personal information in the ordinary course of running our business, including through the receipt of communications such as emails, website enquiries and telephone calls.
We may process the following categories of personal data about you:
Communication Data that includes any communication that you send to us whether that be through the contact form on our website, through email, text, social media messaging, social media posting or any other communication that you send us. We process this data for the purposes of communicating with you, for record keeping and for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to reply to communications sent to us, to keep records and to establish, pursue or defend legal claims.
Customer Data that includes data relating to any purchases of goods and/or services such as your name, title, billing address, delivery address email address, phone number, contact details, purchase details, or any data you supply to us in relation to Go Auction Ltd. carrying out a selected service or contract. We process this data to supply the goods and/or services you have purchased and to keep records of such transactions. Our lawful ground for this processing is the performance of a contract between you and us and/or taking steps at your request to enter into such a contract.
User Data that includes data about how you use our website and any online services together with any data that you post for publication on our website or through other online services. We process this data to operate our website and ensure relevant content is provided to you, to ensure the security of our website, to maintain back- ups of our website and/or databases and to enable publication and administration of our website, other online services and business. Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business.
Technical Data that includes data about your use of our website and online services such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website. The source of this data is from our analytics tracking system. We process this data to analyse your use of our website and other online services, to administer and protect our business and website, to deliver relevant website content and advertisements to you and to understand the effectiveness of our advertising. Our lawful ground for this processing is our legitimate interests which in this case are to enable us to properly administer our website and our business and to grow our business and to decide our marketing strategy.
Marketing Data that includes data about your preferences in receiving marketing from us and your communication preferences. We process this data to enable you to partake in our promotions. Our lawful ground for this processing is our legitimate interests which in this case are to study how customers use our products/services, to develop them, to grow our business and to decide our marketing strategy.
We may use Customer Data, User Data, Technical Data and Marketing Data to deliver relevant website content and advertisements to you (including Facebook adverts or other display advertisements) and to measure or understand the effectiveness of the advertising we serve you. Our lawful ground for this processing is legitimate interests which is to grow our business. We may also use such data to send other marketing communications to you. Our lawful ground for this processing is either consent or legitimate interests (namely to grow our business).
In the course of providing our systems to you (Go Web, Go Office and other bespoke software we develop for you), we process your clients’ data on your behalf. This is only ever done within the scope of our software and according to the functionality and features you have purchased. We do not use this data in any way other than to provide you with the data and services you have purchased from us.
2.2. Sensitive Data
We do not collect any Sensitive Data about you or your customers. Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not collect any information about criminal convictions and offences.
2.3 Who is responsible for this policy?
As our Data Protection Officer (DPO), Nikki Robinson has overall responsibility for the day-to-day implementation of this policy. Her contact details are given above.
We will only use your personal data for a purpose it was collected for or a reasonably compatible purpose if necessary. For more information on this please email us at email@example.com. In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.
We may process your personal data without your knowledge or consent where this is required or permitted by law.
We do not carry out automated decision making or any type of automated profiling.
2.4 How we collect personal data
We may collect data about you by you providing the data directly to us (for example by filling in forms on our site or by sending us emails). We may automatically collect certain data from you as you use our website by using cookies and similar technologies.
We may receive data from third parties such as analytics providers such as Google based outside the EU, advertising networks such as Facebook based outside the EU, such as search information providers such as Google based outside the EU, providers of technical, payment and delivery services, such as data brokers or aggregators.
We may also receive data from publicly availably sources such as Companies House and the Electoral Register based inside the EU.
We collect data relating to your customers or prospects on your behalf – this is only ever done through the use of our systems (e.g. your website). We may also receive data relating to your customers from third parties such as analytics providers such as Google based outside the EU, advertising networks such as Facebook based outside the EU, search information providers such as Google based outside the EU, or providers of payment services such as Sage Pay who may or may not be based outside the EU.
3.1 Fair and lawful processing
We must process personal data fairly and lawfully in accordance with individuals’ rights under the first Principle. This generally means that we should not process personal data unless the individual whose details we are processing has consented to this happening.
If we cannot apply a lawful basis, our processing does not conform to the first principle and will be unlawful. Data subjects have the right to have any data unlawfully processed erased.
3.2 Registration with the Information Commissioner’s Office
We must maintain the appropriate registration with the Information Commissioners Office in order to continue lawfully processing data.
3.3. Contractual obligations
As a data processor and software provider, we must comply with our contractual obligations and act only on the documented instructions of the data controller. As a data processor, we must:
Not use a sub-processor without written authorisation of the data controller
Co-operate fully with the ICO or other supervisory authority
Ensure the security of the processing
Keep accurate records of processing activities
Notify the controller of any personal data breaches
If you are in any doubt about how we handle data, contact our Data Protection Officer for clarification.
Our responsibilities as the data processor are as follows:
Analysing and documenting the type of personal data we hold
Checking procedures to ensure they cover all the rights of the individual
Identify the lawful basis for processing data
Ensuring consent procedures are lawful
Implementing and reviewing procedures to detect, report and investigate personal data breaches
Store data in safe and secure ways
Assess the risk that could be posed to individual rights and freedoms should data be compromised
Your responsibilities as the data controller are as follows:
Fully understand your obligations as the data controller and ensure staff are using the systems we provide in a lawful manner and in compliance with the principles of GDPR
Do not use data in any unlawful way
Do not store data incorrectly, be careless with it or otherwise cause us to breach data protection laws and our policies through your actions
Comply with this policy at all times
Raise any concerns, notify any breaches or errors, and report anything suspicious or contradictory to this policy or our legal obligations to our DPO without delay
Responsibilities of the Data Protection Officer:
Keeping the board updated about data protection responsibilities, risks and issues
Reviewing all data protection procedures and policies on a regular basis
Arranging data protection training and advice for all staff members and those included in this policy
Answering questions on data protection from staff, board members, clients and other stakeholders
Responding to individuals such as clients and employees who wish to know which data is being held on them by us
Checking and approving with third parties that handle the company’s data any contracts or agreement regarding data processing
Ensure all systems, services, software and equipment meet acceptable security standards
Checking and scanning security hardware and software regularly to ensure it is functioning properly
Researching third-party services, such as cloud services the company is considering using to store or process data
Coordinating with the digital marketing lead to ensure all marketing initiatives adhere to data protection laws and the company’s Data Protection Policy
3.5 Accuracy and relevance
We will ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purpose for which it was obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless the individual concerned has agreed to this or would otherwise reasonably expect this.
Individuals may ask that inaccurate personal data relating to them is corrected – our software gives you as the Data Controller the means to do this.
We have put in place security measures to prevent your personal data, and that of your clients, from being accidentally lost, used, altered, disclosed, or accessed without authorisation. We also allow access to your personal data only to those employees and associates who have a business need to know such data. They will only process your personal data on our instructions and they must keep it confidential.
We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to.
4.1. How we store data
In cases when data is stored on paper, it will be kept in a secure place where unauthorised parties cannot access it. Any personal data stored on paper will be shredded when it is no longer needed.
Data we store on our computers and servers is protected by strong passwords that are changed regularly. We ask all staff to use a password manager to create and store their passwords and the passwords we hold on behalf of clients.
Data stored on removable storage devices is encrypted or password protected and locked away securely when they are not being used
The cloud storage and hosting facilities we use are GDPR compliant – we use Microsoft Azure and Amazon Web Services. The hosting partner we use (Nimbus Hosting) is fully GDPR compliant and ISO accredited.
Data is regularly backed up in line with our backup procedures.
Data is never saved directly to mobile devices such as laptops, tablets or smartphones - we use ‘Egnyte’ service for data storage.
Transferring data internationally
There are restrictions on international transfers of personal data. We will not transfer or store personal outside of the EU.
We must retain personal data for no longer than is necessary. What is necessary will depend on the circumstances of each case, taking into account the reasons that the personal data was obtained, but should be determined in a manner consistent with our data retention guidelines, set out below.
5.1 Data retention guidelines
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
When deciding what the correct time is to keep the data for we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.
For tax purposes the law requires us to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they stop being customers.
In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
We will ensure that personal data is securely disposed of when it is no longer needed – for example, data that our clients send to us for processing or data that we use as part of our software development and testing.
We will not delete your client data without your prior knowledge and consent, although the software we provide you with may offer functionality for you to select and delete your own client records.
Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent.
You can see more about these rights at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you wish to exercise any of the rights set out above, please email us at firstname.lastname@example.org
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you.
If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.
7.1 When to supply a privacy notice
A privacy notice must be supplied at the time the data is obtained if obtained directly from the data subject. If the data is not obtained directly from the data subject, the privacy notice must be provided within a reasonable period of having obtained the data, which mean within one month.
If the data is being used to communicate with the individual, then the privacy notice must be supplied at the latest when the first communication takes place.
If disclosure to another recipient is envisaged, then the privacy notice must be supplied prior to the data being disclosed.
7.2 What to include in a privacy notice
Privacy notices must be concise, transparent, intelligible and easily accessible. They must be written in clear and plain language. The following information must be included in a privacy notice to all data subjects:
Identification and contact information of the data controller and the data protection officer
The purpose of processing the data and the lawful basis for doing so
The legitimate interests of the controller or third party, if applicable
The right to withdraw consent at any time, if applicable
Detailed information of any transfers to third countries and safeguards in place
The retention period of the data or the criteria used to determine the retention period, including details for the data disposal after the retention period
The right to lodge a complaint with the ICO, and internal complaint procedures
The source of the personal data, and whether it came from publicly available sources (only for data not obtained directly from the data subject)
Any existence of automated decision making, including profiling and information about how those decisions are made, their significances and consequences to the data subject
Whether the provision of personal data is part of a statutory of contractual requirement or obligation and possible consequences for any failure to provide the data (only for data obtained directly from the data subject)
8.1 What is a subject access request?
An individual has the right to receive confirmation that their data is being processed, access to their personal data and supplementary information which means the information which should be provided in a privacy notice.
8.2 How we deal with subject access requests
We must provide an individual with a copy of the information the request, free of charge. This must occur without delay, and within one month of receipt. We endeavour to provide data subjects access to their information in commonly used electronic formats, and where possible, provide direct access to the information through a remote accessed secure system.
If complying with the request is complex or numerous, the deadline can be extended by two months, but the individual must be informed within one month. You must obtain approval from the DPO before extending the deadline.
We can refuse to respond to certain requests, and can, in circumstances of the request being manifestly unfounded or excessive, charge a fee. If the request is for a large quantity of data, we can request the individual specify the information they are requesting. This can only be done with express permission from the DPO.
Once a subject access request has been made, you must not change or amend any of the data that has been requested. Doing so is a criminal offence.
8.3 Data portability requests
We must provide the data requested in a structured, commonly used and machine-readable format. This would normally be a CSV file, although other formats are acceptable. We must provide this data either to the individual who has requested it, or to the data controller they have requested it be sent to. This must be done free of charge and without delay, and no later than one month. This can be extended to two months for complex or numerous requests, but the individual must be informed of the extension within one month and you must receive express permission from the DPO first.
9.1 What is the right to erasure?
Individuals have a right to have their data erased and for processing to cease in the following circumstances:
Where the personal data is no longer necessary in relation to the purpose for which it was originally collected and / or processed
Where consent is withdrawn
Where the individual objects to processing and there is no overriding legitimate interest for continuing the processing
The personal data was unlawfully processed or otherwise breached data protection laws
To comply with a legal obligation
The processing relates to a child
9.2 How we deal with the right to erasure
We can only refuse to comply with a right to erasure in the following circumstances:
To exercise the right of freedom of expression and information
To comply with a legal obligation for the performance of a public interest task or exercise of official authority
For public health purposes in the public interest
For archiving purposes in the public interest, scientific research, historical research or statistical purposes
The exercise or defence of legal claims
If personal data that needs to be erased has been passed onto other parties or recipients, they must be contacted and informed of their obligation to erase the data. If the individual asks, we must inform them of those recipients.
9.2 The right to object
Individuals have the right to object to their data being used on grounds relating to their particular situation. We must cease processing unless:
We have legitimate grounds for processing which override the interests, rights and freedoms of the individual.
The processing relates to the establishment, exercise or defence of legal claims.
We must always inform the individual of their right to object at the first point of communication, i.e. in the privacy notice. We must offer a way for individuals to object online.
9.3 The right to restrict automated profiling or decision making
We may only carry out automated profiling or decision making that has a legal or similarly significant effect on an individual in the following circumstances:
It is necessary for the entry into or performance of a contract.
Based on the individual’s explicit consent.
Otherwise authorised by law.
In these circumstances, we must:
Give individuals detailed information about the automated processing.
Offer simple ways for them to request human intervention or challenge any decision about them.
Carry out regular checks and user testing to ensure our systems are working as intended.
As a data processor, we have written contracts in place with any third parties that we use. The contracts contain specific clauses which set out our and their liabilities, obligations and responsibilities.
Our contracts must comply with the standards set out by the ICO and, where possible, follow the standard contractual clauses which are available. Our contracts with [data controllers (and/or) data processors] must set out the subject matter and duration of the processing, the nature and stated purpose of the processing activities, the types of personal data and categories of data subject, and the obligations and rights of the controller.
At a minimum, our contracts must include terms that specify:
Acting only on written instructions
Those involved in processing the data are subject to a duty of confidence
Appropriate measures will be taken to ensure the security of the processing
Sub-processors will only be engaged with the prior consent of the controller and under a written contract
The controller will assist the processor in dealing with subject access requests and allowing data subjects to exercise their rights under GDPR
The processor will assist the controller in meeting its GDPR obligations in relation to the security of processing, notification of data breaches and implementation of Data Protection Impact Assessments
Delete or return all personal data at the end of the contract
Submit to regular audits and inspections, and provide whatever information necessary for the controller and processor to meet their legal obligations.
Nothing will be done by either the controller or processor to infringe on GDPR.
10.2 Third Party Links
The Go Auction website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
11.1. Data audits
Regular data audits to manage and mitigate risks will take place. This audit will contain information on what data is held, where it is stored, how it is used, who is responsible and any further regulations or retention timescales that may be relevant.
Everyone must observe this policy. The DPO has overall responsibility for this policy. Go Auction will keep this policy under review and amend or change it as required. Go Auction employees will notify the DPO of any breaches of this policy and will comply with this policy fully and at all times.
Go Auction staff will receive adequate training on provisions of data protection law specific for their role. Staff must complete all training as requested. If a member of staff moves role or responsibilities, the staff member is responsible for requesting new data protection training relevant to the new role or responsibilities.
12.1 Reporting breaches
Any breach of this policy or of data protection laws must be reported as soon as practically possible. Go Auction has a legal obligation to report any data breaches that pose a risk to the Information Commissioners Office within 72 hours. This will be done in accordance with the guidelines available on the ICO website (https://ico.org.uk/for-organisations/report-a-breach/).
All members of staff have an obligation to report actual or potential data protection compliance failures. This allows us to:
Investigate the failure and take remedial steps if necessary
Maintain a register of compliance failures
Notify the ICO of any compliance failures that are material either in their own right or as part of a pattern of failures.
Any member of staff who fails to notify our DPO of a breach, or is found to have known or suspected a breach has occurred but has not followed the correct reporting procedures will be liable to disciplinary action.
12.2. Failure to comply
We take compliance with this policy very seriously. Failure to comply puts us and our clients at risk. The importance of this policy means that failure to comply with any requirement may lead to disciplinary action under our procedures which may result in dismissal or withdrawal of services to the data controller.
If you have any questions or concerns about anything in this policy, do not hesitate to contact the DPO.