Data Protection Statement
1. Policy
When Somerford processes personal data related to our employees, customers and other stakeholders, we strive to comply at all times with the Data Protection Act 2018 and the General Data Protection Regulations (GDPR). We do not hold or process any customer data on our systems other than business contact and customer account information used for managing our relationship with customers or pursuing our legitimate business interests. It is Somerford Associates’ policy to avoid becoming a Data Processor on behalf of our customers.
2. Partner cloud hosting
Our customers' data may be held on our partners’ systems where the services are being provided as a cloud hosted solution by that partner. Any security and data protection terms are to be agreed directly between the customer and the partner organisation.
3. Somerford delivery of professional services
Where Somerford employees are engaged to provide installation, maintenance or other professional services for our customers, these will be performed using the customer’s systems and data (albeit procured from our partner) under the direct supervision of the customer. We will only access the customer systems and data in order to help the customer set up, operate and maintain the services for themselves.
We are happy to confirm that while Somerford employees are engaged in this activity, they will:
- have been suitably security screened beforehand;
- be suitably trained and qualified to undertake the task at hand;
- perform their tasks with all due care and professionalism, in accordance with the agreement and any agreed Statement of Work (SoW);
- follow all reasonable customer security and data protection policies and procedures during the conduct of their work, and in any case comply with prevailing Data Protection law.
We expect that the customer will:
- avoid unnecessarily exposing Somerford employees to the customer’s live personal data, payment card data or other confidential data;
- and, where this is unavoidable, advise Somerford employees beforehand of the sensitive nature of the data they are about to handle and advise of any customer specific handling constraints so that our staff can take all due care.
