In order for personal data to be processed in a transparent manner we must be sure that we have informed the data subject of how their data is processed, the parties it is shared with, how long their data is retained and any transfers of their personal data to a third country.

Under normal circumstance we will inform the data subject of all of this through a privacy notice, which we must provide to them at the point of which we are collecting their data.

Any privacy notice must be written in a manner that is easy for the data subject to understand and where the data subject may be less able to understand (i.e. for a child) additional care must be taken to ensure it remains clear.

In circumstances where we receive a data subject’s data from a source other than the data subject, we must inform them of all of this within 30 days of receiving the data or before we begin to process it (whichever is the soonest).