Data Protection Policies

Your Personal Information
To perform our role, we need to collect personal information such as names, e-mail and postal addresses, telephone contact numbers and other information which is necessary to provide our regulatory services or to engage in commercial transactions with suppliers. 

Before we store or process any personal information about you, we will ask for you to explicitly consent to this use. The details of this use are set out in our Privacy statement which can be found here. If you object to this use, please let us know immediately. You can email us at info@impress.press with the subject line “Data Use Objection” or write to the address provided below; you can also make a request over the phone. Please identify yourself when making the request.

If you are unhappy with the service you have received from IMPRESS regarding your personal information, you should tell us as soon as possible so we can look into the matter and address it. Alternatively, you can engage our service complaints process and your complaint may be reviewed by our external, independent Service Complaint Reviewer. You also have a right to lodge a complaint against us with the Information Commissioner’s Office, you can find out more information about making a complaint to the ICO here.

Request Access to Your Personal Information
You can find out if we hold any personal information about you by making a ‘subject access request’ under the Data Protection Act. To make a request to IMPRESS for any personal information we may hold about you, you need to email us at info@impress.press with the subject line “Data Subject Acess Request” or write to the address provided below; you can also make a request over the phone. You must also identify yourself when making the request. We will respond within one month of receipt of the request.

If we do hold information about you, we will provide you with a data subject request notification that will outline the following:

  • The categories of your data we store and process.
  • Where we collected the data from, if this was not from you.
  • What the purpose for processing your data was.
  • Who the data was shared with.
  • How long we intend to store the data.
  • If we process your data in an automated way, including if we use it for profiling purposes.
  • A copy of the data we hold.

We will also inform you of your right to request that we correct, erase or restrict the processing of your data and of your right to lodge a complaint against us with the Information Commissioner’s Office.

The notification will be provided free of charge. However, we may charge an administrative fee in instances of repeated requests for the same information. We will always provide the information electronically, unless you request it in writing. 

If we refuse to grant the request, we will respond within one month of your request, setting out reasons why we have refused your request.

Update or Erase Your Personal Information
If you think the data we store and process about you is inaccurate or incomplete, you can make a request to us to rectify this. To make a request to IMPRESS to rectify any personal information we may hold about you, you need to email us at info@impress.press with the subject line “Data Subject Rectification Request” or write to the address provided below; you can also make a request over the phone. You must also identify yourself when making the request.

If you would like us to erase any data we store and process, you can make a request to us to do so. To make a request to IMPRESS, you need to email us at info@impress.press with the subject line “Data Subject Erasure Request” or write to the address provided below; you can also make a request over the phone. You must also identify yourself when making the request. We will to respond within one month of receipt of the request.

We will let any of our third-party processors know of any changes we have made to rectify inaccurate or incomplete information or to erase data. We will also inform you of your right to lodge a complaint against us with the Information Commissioner’s Office.

If we refuse to grant the request, we will respond within one month of your request, setting out reasons why we have refused your request.

Please note we will erase data in instances where: the data subject objects to the storing or processing of data, where the data subject withdraws their consent, it is no longer necessary for the purpose which IMPRESS originally collected or processed it for and/or there is no overriding legitimate interest to continue this processing.

Data Breach
Data breaches can happen. If we are concerned that a data breach has taken place that poses a high risk to your rights and freedoms, we will let you know within 72 hours of the breach being discovered. We will let you know what the data breach was and what we think you should do to avoid any adverse effect to you. We will also let the Information Commissioner’s Office know and work with them to minimise the impact of the breach.

Data Security Measures
We have a number of security measures in place to ensure the data we store and process are secure including:

  • Storing data in our password-protected CRM, which is hosted on very secure Microsoft London servers;
  • Retaining ongoing support from industry-leading IT companies for both our CRM and our office servers, ensuring that our data security is always monitored and up to date;
  • Keeping two forms of backup: a backup in the office, and a Disaster Recovery backup that takes a backup of the main and exchange server every hour and automatically sends these to a data centre that is owned and operated by our external IT company;
  • Encrypting our server and backups of our server. The server is protected by hardware firewall and an advanced comprehensive gateway security suite;
  • Only allowing staff to access the server when in the office, or through a 2-factor authentication VPN connection when outside the office;
  • Utilising a secure digital board portal solution for sharing of confidential board data rather than distributing it by email, post or other channels.