Royal British Legion Industries Limited
Data Protection Statement
We may need to collect your personal data to provide with services offered by Royal British
Legion Industries Limited (RBLI) and that you have asked us to provide. We may also collect
personal data in those instances when the law says that we must.
Sometimes we collect personal data for one area of our services and we may need to use this to
provide you with another service. We may also use it for the prevention and detection of fraud.
We will keep your personal data safe and secure. We will not share it with other organisations
without your consent, unless we are required or permitted by law to do so.
The Data Protection Act 1998 (DPA98) is based on eight legally enforceable principles that
organisations, such as RBLI, must apply when they process your personal data. The DPA98
states that all personal information must:
• Be processed fairly and lawfully.
• Only be obtained and processed for specified and lawful purposes.
• Be adequate and relevant for the purpose for which intended and not excessive.
• Be accurate and, where necessary, kept up to date.
• Not be kept longer than necessary.
• Be processed in accordance with the data subject’s right.
• Be kept secure.
• Not be transferred to other countries without adequate protection for the rights and
freedoms of the data subject.
What is personal data?
Personal data (or information) is any data which, on its own or referenced against other data held
by RBLI, can be used to identify a living individual.
This includes all the obvious details that RBLI might hold about you, such as name, address,
national insurance number, employment history, qualifications etc. It might also include
expressions of opinion about you and RBLI’s actions, intentions or recommendations on your
The DPA98 recognises that some types of personal data are more sensitive than others. There
are additional rules for processing data about your ethnic origin, religious beliefs, trades union
membership, party political opinions, sexuality, health, involvement in criminal proceedings, etc.
What is meant by “processing” personal data?
Processing personal data includes collecting, storing, accessing, changing, disclosing, copying
and destroying any information about you. The amount of personal data we have about you and
how we process it depends on which of RBLI’s services you use.
Sometimes we collect personal data for one of RBLI’s services and we may need to use it to
provide you with another service. We will always try to tell you if we share your personal data
between different RBLI services.
Who processes my personal data?
RBLI’s employees or appointed sub-contractors can access and process your personal data as
part of their official duties that support the services offered by our organisation, but such access
and processing is limited to the data needed for a specific purpose. They must not disclose your
personal data to anyone else without your consent, unless they are legally obliged or empowered
to do so in terms of the relevant provisions of the DPA98.
You can write and ask us to stop processing your personal data at any time. You must explain
what processing you want us to stop and why. We must reply within 21 days to let you know what
we have done about your request.
Can I seek access to my personal data?
The DPA98 gives you a general right of access to personal data that relates to you. Access
requests must be made in writing with enough information to locate the data requested and proof
that you are the data subject, or that you are authorised to request access to the personal data on
behalf of the data subject. See below to obtain the subject access request form. This form should
be accompanied by a payment of £10, as allowed in DPA98.
RBLI must respond within 40 days confirming:
• A description of the personal data.
• Why the data is held.
• Who else the data might have been given to.
• A copy of the data.
• Any explanation of any technical terms or abbreviations.
• Any information about the original source of the data.
We can withhold some data if, for example, it refers to other people who have not consented to
disclosure, if disclosure might cause serious harm to you or anyone else, or might prejudice crime
prevention or legal proceedings. Even if we cannot provide you with copies of the data we will
confirm what type of data we hold and why we hold it.
Can I see personal data about other people?
You only have the right to access your own personal data. You do not have the right to access
personal data about other persons unless you have written proof of your authority to act on behalf
of the data subject. Even if you meet these requirements we may need to ask you for further
information before we reply or refuse access because of our duty to keep personal data
Obtaining personal data from RBLI sources for an unauthorised purpose, or unauthorised
disclosure of such personal data to a third party are offences under the DPA98.
How can I be sure my data is accurate?
The best way to be sure is to let us know about any changes in circumstances that might affect
the services we provide to you.
Under the DPA98 RBLI must try to keep your personal data accurate and up to date. If you think
that your personal data is incorrect you can write telling us why and asking us to correct the data.
We must reply within 21 days to let you know what we have done about your request.
If we agree that your personal data is incorrect we will take appropriate action. If we do not agree
we will add a note to your file that you disagree with our version of the data.
Further detailed information about your rights under the Data Protection Act 1998 is available on
the Information Commissioner’s website at http://www.informationcommissioner.co.uk or by
telephone on 01625 545745
Our Data Protection Officer is:
Royal British Legion Industries Limited
Royal British Legion Village
Kent ME20 7NL
Telephone number : 01622 795900