GDPR Privacy Notice

Who are we?

Manuscript Pen Company Ltd is a family-owned company established in 1989 and based in Highley, Shropshire, England. We are one of the few remaining Companies in the world specialising in the development, production and sale of fountain pen and dip pen based calligraphy products as well as wax seals.

GDPR Lead

Our GDPR Lead, Charlie Stockbridge, can be contacted directly by emailing gdpr@manuscriptpen.com or by phone on 01746 861236.

Data

Manuscript Pen Company Ltd is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified, then you can be assured it would only be used in accordance with this privacy statement.

Data we collect

Function	Data Collected	How we manage this data
Account Management	Name, Role, Contact information (including address, phone numbers and email addresses) and product preferences.	Centrally stored in our commercial system plus excel spreadsheets kept within folders on the server. The server is located on a secure, managed and backed-up server located at Leonardt Limited, Highley.
Order Processing - businesses	Name, Role, Contact information (including address, phone numbers and email addresses) and products ordered.	Centrally stored in our commercial system which is located on a secure, managed and backed-up server located at Leonardt Limited, Highley. Each order is printed off together with a  customer summary information sheet and filed in a secure room within the offices.
Order Processing - individuals	Name, Role, Contact information (including address, phone numbers and email addresses) and products ordered.	As above but customer details (ie anything which could identify any individuals) are removed and orders are filed away in number order in a locked filing cabinet within the secure room in the offices. Customer information is stored in a secure server for despatch purposes only. 3rd party freight forwarders are reviewed for compliance with GDPR policies on a 6 monthly basis.
Website	Name, Contact information (including address, phone numbers and email addresses),	Hosted by our Website host Glovesure. Glovesure store basic server access logs for debugging, security and service review but do not use any information collected for any purposes, including marketing. Orders originating from the website are processed in the same manner as stated above (see Order Processing - individuals)
Offsite Backups	All data that we have agreed with our IT support company (Virtue Technology Ltd) to be backed up off site, including system databases and working documents such as spreadsheets	Stored in an environmentally managed Tier 4 UK based data center and fully encrypted during transit and at rest. Manuscript Pen Company Ltd Limited to not have access to this data
Marketing	Name and address	Stored in a secure third party server which is subject to computer processing to provide the service subscribed to by its users and to improve the overall service, The host servers are located within the European Union.

Our legal basis for processing for the personal data:

In line with Article 6(1b), for all cases (except marketing), processing is necessary for the performance of a contract to which the customer has agreed. For our marketing activities, we gain consent from each data subject and this consent may be withdrawn using a link on the bottom of any marketing related email.

By consenting to this privacy notice you are giving Manuscript Pen Company Ltd Limited permission to process the personal data supplied specifically for the purposes identified. In doing so, Manuscript Pen Company Ltd Limited must assume that the data has been collected under the terms identified in Article 6 ‘Lawfulness of processing’ of the General Data Protection Regulation.

Disclosure

Manuscript Pen Company Ltd Limited will share limited personal data to third parties to enable us to perform our contract, such as arranging deliveries with manufacturers. Unless legally obliged to, we will never give or sell your data to a third party and we will not allow your personal data to be used by a third party for any reason other than originally intended.

Under the GDPR, we will have in place an appropriate data sharing agreement with any third party supplier or manufacturer we use.

Retention periods

Manuscript Pen Company Ltd Limited process personal data for the following periods;

• • Account Management: Duration of engagement plus 7 Years*
• • Order Processing: Duration of engagement plus 7 Years*
• • Support Services: Duration of engagement plus 7 Years*
• • Offsite Backups: Duration of the contract plus 1 month
• • Marketing: 2 years or until withdrawal of consent.

* includes the legal requirement of retention of financial data for 7 years.

For more information on storage and processing security, please contact us to discuss.

Your rights as a data subject

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: in the event that Organisation Name refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain.

All of the above requests will be dealt with in line with Manuscript Pen Company Ltd Limited Subject Access Procedure and will shared with the customer should a request come from directly a subject.

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by Manuscript Pen Company Ltd (or third parties as described above), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and Manuscript Pen Company Ltd Limited’s GDPR Lead.

Document Owner and Approval

The GDPR Lead is the owner of this document and is responsible for ensuring that this record is reviewed in line with the review requirements of the GDPR.

A current version of this document is available to all members of staff on the company network and is published on the company website