Data Protection

Introduction

Under data protection laws and regulations, you have rights in relation to your own personal data that we process. This document notifies you of your rights and how you can exercise them. Please note that not all rights are absolute, and some only apply in certain circumstances.

Fees

In most cases we cannot charge a fee to comply with a request when you exercise your rights. However, we can charge a “reasonable fee” for the administrative costs of complying with the request if it is manifestly unfounded or excessive. If we decide to charge a fee, we will contact you promptly and inform you. Alternatively, we can refuse to comply with a manifestly unfounded or excessive request.

Responding to your request

We must respond to you without undue delay and at the latest within 28 days providing that we have received identification documents that we may ask for to confirm the identity of the person making the request and any fee. When we respond we will let you know whether we have actioned your request or that we have refused your request. 

If we need to extend the time to respond to you, by a further two months, if the request is complex or we have received a number of requests from you, we will let you know within 28 days of receiving your request and explain why the extension is necessary.

Identification

If you have doubts about the identity of the person making the request, we can ask for more information to confirm who they are. We will let you know without undue delay and within 28 days if we need more information from you to confirm your identity. 

If we cannot take action

We will inform you without undue delay and within 28 days of receipt of your request if we cannot take action, request a reasonable fee or request additional information to identify you to explain:

•    the reasons we are not taking action;
•    your right to make a complaint to the ICO or another supervisory authority; and
•    your ability to seek to enforce your rights through a judicial remedy.

Your rights

Right to be informed

You have a right to be informed by us about the personal information that we have collected on you, the source of that information, why we need it and what we do with it.

We provide this ‘privacy information’ to you in our Privacy Notice which is attached to this document.

Our up-to-date Privacy Notice can be found on our website at www.tufton.com at all times. If we make any changes to our Privacy Notice an updated version will be posted to the same location on our website. It is your responsibility to check for any updates.

Right of access

You have a right to obtain a copy of your personal information that we process and supplementary information. This is sometimes referred to as subject access request or “SAR”. This right is intended to help you to understand how and why we are using your data.

You can make a SAR verbally or in writing. You do not need to use a specific form of words, refer to legislation or direct the request to a specific contact.

Right to rectification

You have the right to have inaccurate personal data rectified and may also be able to have incomplete personal data completed depending on the purposes for the processing. 

This right, when exercised, imposes a specific obligation on us to reconsider the accuracy of your personal data that we process you’re your request. In doing so we will take reasonable steps to satisfy ourselves that the personal data we hold on you is accurate and if necessary, rectify the personal data. We will consider any arguments and evidence that you provide.

You also have a right to request restriction of the processing of your personal data when you contest its accuracy and while we are checking it. 

Right to erasure

You have the right to have personal data erased also known as the ‘right to be forgotten’. The right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances You have the right to have your personal data erased if:

•    the personal data is no longer necessary for the purpose which we originally collected or processed it for;
•    we are relying on consent as your lawful basis for holding the data, and you withdraw your consent;
•    we are relying on legitimate interests as our basis for processing and you object to the processing of your data, and there is no overriding legitimate interest to continue this processing;
•    we are processing your personal data for direct marketing purposes and you object to that processing;
•    we have processed the personal data unlawfully;
•    we have to do it to comply with a legal obligation; or
•    we have processed the personal data to offer information society services to a child.

Right to restrict processing

You have the right to restrict the processing of your personal data in certain circumstances. This means that you can limit the way that we use your data where you have a particular reason for wanting the restriction. This may be because you have issues with the content of the information we hold or how we have processed your data. You  have the right to request you restrict the processing of your personal data in the following circumstances:

•    you contest the accuracy of your personal data, and we are verifying the accuracy of the data;
•    the data has been unlawfully processed and you oppose erasure and request restriction instead;
•    we no longer need the personal data, but you need us to keep it to establish, exercise or defend a legal claim; or
•    you have objected to us processing your data when we have a legitimate interest, and we are considering whether our legitimate grounds override those of yours.

Right to data portability

The right to data portability gives you the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format. It also gives you the right to request that we transmit this data directly to another controller if it is technically feasible. This right applies when:

•    we process your information based on your consent or for the performance of a contract between you and us; and
•    when we are carrying out the processing by automated means.

This allows you to manage and reuse your personal data. 

Right to object

This right gives you the right to object to the processing of your personal data at any time. An objection may be in relation to all of your personal data or only to certain information. It may also only relate to a particular purpose we are processing your data for.

This right to object only applies in certain circumstances. Whether it applies depends on our purposes for processing and our lawful basis for processing. You do have the absolute right to object to the processing of your personal data if it is for direct marketing purposes. You can also object but the right to object is not absolute, if the processing is for:

•    a task carried out in the public interest;
•    the exercise of official authority vested in us; or
•    our legitimate interests (or those of a third party).

Rights related to automated decision-making including profiling

Automated individual decision-making is a decision made by automated means without any human involvement.

Profiling is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

How to exercise your rights

You can exercise your rights by sending a written request by post to any office in the Tufton Group or by email to your Tufton contact. You may also make your request verbally to your Tufton contact.

UK representative Office:

Tufton Investment Management Ltd
70 Pall Mall
London
SW1Y 5RS
United Kingdom

EU representative office:

Tufton Asset Management Limited
142 Franklin Roosevelt
Limassol
CY-3011
Cyprus

Further Information on your rights

If you require any further information from us on the contents of this document, your rights or how to exercise your rights, please contact us.