Non-substantial updates to this Privacy Notice will be notified to Participants by posting details on the STAR Website.
2.1 CTHS will collect, from each Participant, Participant Personal Data, including the name, address, telephone number and email contact details for each Participant Representative, for use by CTHS and/or other Participants. Each Participant will promptly update STAR on any changes to the personal data in relation to its Representatives notified to STAR.
2.3 STAR does not require any “special category” personal data (as defined under data protection law) for STAR purposes, and accordingly requests each Participant not to communicate (and to procure that none of its Representatives communicate) to CTHS any personal details revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation or commission (or alleged commission) of any offence or proceedings for any offence committed (or alleged to have been committed) by such Participant Representative or the disposal of such proceedings or sentence in such proceedings.
2.4 In addition to collecting Participant Personal Data directly from Participants, CTHS may collect personal data in the following ways:
2.5 If any application to become a Participant of STAR is rejected, CTHS may retain personal data relating to any individual who would have been a Participant Representative had the application been successful. This personal data will normally be retained for no more than 6 months, unless there is a specific need to retain the personal data for longer.
3.1 Data protection law requires that CTHS meets certain conditions before STAR is allowed to use any Participant Personal Data. CTHS relies on a condition known as “legitimate interests” in order to process the Participant Personal Data for specified purposes. For example, it is in CTHS’s legitimate interests to Process Participant Personal Data where it is required by CTHS in connection with the following purposes (together the “STAR Purposes“):
3.2 CTHS also uses personal data to meet its legal obligations, for example to hold necessary information as part of CTHS’s data protection impact assessments and compliance programme record-keeping obligations.
3.3 Where CTHS is relying on “legitimate interests”, CTHS will ensure that the collection and processing of Participant Personal Data:
3.4 All other Participants will have the right to access and use Participant Personal Data for the purposes of the STAR initiative, including resolution of disputes, and to give notices to any other Participant in accordance with the Servicing Agreement.
3.5 CTHS will only disclose Participant Personal:
4.1 CTHS will not transfer, Process or store Participant Personal Data in a country outside the UK or the EEA unless:
5.1 Under data protection law, Participant Representatives have the following data subject rights in relation to their personal data:
5.2 Each Participant Representative has the right to request access to, and receive a copy of, the personal data held about them.
5.3 To exercise a data subject right under the data protection law, each Participant Representative should make a request in writing to STAR’s Company Secretary at Dakota House, 25 Falcon Court, Preston Farm Business Park, Stockton-on-Tees, TS18 3TY, UK.
7.1 We will keep Participant Personal Data for as long as we have a relationship with you, and for a period of twenty-eight (28) days thereafter. We will only retain Participant Personal Data after this time if we are required to do so to comply with the law, or if there are outstanding claims or complaints that will reasonably require Participant Personal Data to be retained.
8.1 CTHS has implemented various technical and organisational measures designed to protect personal data against unauthorised or unlawful processing. The systems we use to store personal data are compliant with ISO27001 and we ensure that third party data storage providers also meet this standard.
9.2 If any Participant, or any Participant Representative, is not happy with the way in which personal data is held or Processed by CTHS, or if any Participant, or any Participant Representative is not satisfied with CTHS’s handling of any request in relation to the rights of data subjects, CTHS request that in the first instance a complaint is made to the CTHS Company Secretary at the contact details set out above. However, any Participant, or Participant Representative, always has the right to complain regarding data protection matters to the ICO. The ICO is the UK’s independent body set up to uphold information rights. More about the ICO (including how to make a complaint) can be found on its website (https://ico.org.uk/).