Coronavirus - An operational update with a business as usual approach Find Out More.

Privacy Policy

National Accident Repair Group Privacy Policy & Procedures

Purpose of policy

This policy details the approach National Accident Repair Group Limited (National) takes to the privacy of data provided to us.
Details of how data is processed and stored are available in the ‘National Data Retention Policy’.
The policy details the rights of people whose data we hold and process (Data Subjects) and how they can exercise their rights.
It also provides information as to the process National will adopt to satisfy these requests. A condensed version of this policy is available for customers, written in ‘plain language’.

Scope of Policy

This policy and its associated processes focus towards a National customer policyholder / driver. Details for National employees are covered in the National HR processes.

National acts in the majority of cases as a ‘Data Processor’ under GDPR for its clients, with its contracted network sub processors acting as ‘Data Sub Processors’.

For the purposes of this policy both the above are referred too as the same, unless specifically detailed otherwise.

Data rights for data subjects are managed by the National Data Protection Officer (DPO) The rights of data subjects are as follows:

Right to Access

All data subjects have the right to access any data that National holds on them.

The data subject will request access via the ‘accessing their rights’ section of this document.

The data subject will detail which elements of their data they wish to access.

Within 24hrs of a request being received the ‘data controller’ should be informed.

The request will be forwarded to the National Claims Director for collation of the data requested and they will provide a CSV file or PDF of the specific data that has been requested to the National DPO for forwarding to the data subject.

This must be supplied to the data subject by National within 40 days from the date of when National receive back the ‘My data rights’ form.

Right to Rectification

The data subject can at any time request any part of their data to be rectified should they feel it has been recorded inaccurately.

This can be done in a number of ways:

  • By email or call to the National Claims Centre where all calls are recorded. This data should be rectified immediately and confirmation of the change sent to the data subject within 24hrs via email or over recorded telephone call.
  • By following the ‘Accessing their rights’ section of this document. Once the data has been rectified confirmation must be sent via email to the data subject.

In all cases the data subject should be very specific regarding:

  • What data is incorrect.
  • What it should be correctly amended too.

This should be rectified within 40 days of request and confirmation in writing (email or hard copy) should be provided.

Right to Erasure

A data subject may at any time request that their data is erased.

This erasure must include all records held on any system of National or its Network sub processors or partners and must be in its entirety.

The data subject can request this by following the ‘Accessing their rights’ section of this document.

Upon receipt the request will be passed onto the National Claims Director for action. They will locate all correspondence and data relating to the data subject and delete it in its entirety. In addition, they will contact the respective sub processor or partner who has been assigned any repair relating to the data subject to also delete all data they have on the data subject in its entirety.

Once they have confirmation that this process has been completed they will contact the National DPO to confirm all data has been deleted.

Within 24hrs of a request being received the ‘data controller’ should be informed.

For right to erasure requests, as National requires data to allow the processing of repairs within the network and the provision of services at the point a data request is given the data subject will be informed that services can no longer be provided and will cease with immediate effect.

In addition, they will be informed that any warranty on repairs completed will be rendered null and void as the absence of data does not allow confirmation any repair was ever conducted.

Confirmation of erasure to the data subject by National must be within 40 days from the date of when National receive back the ‘My data rights’ form.

Right to Restrict Processing

All data subjects have the right to request restriction of processing of their data. This normally would not be for an indefinite period, but for a specific reason.

Restriction of data would normally mean that National cannot process the data but can store it (for instance after a repair where it is then stored for warranty purposes).

An example of a restriction of processing may be where the data subject has requested restriction of processing because they challenge the accuracy of the data held and wish to restrict processing whilst they confirm the data.

The data subject can request restriction of processing of their data by following the ‘Accessing their rights’ section of this document.

Upon receipt the request will be actioned by the National DPO.

They will communicate the instruction to the National Claims Director for implementation, including contact the respective sub processor or partner who has been assigned any repair relating to the data subject to also restrict processing as required.

Within 24hrs of a request being received the ‘data controller’ should be informed.

Confirmation that processing has been restricted to the data subject by National must be within 40 days from the date of when National receive back the ‘My data rights’ form.

Right to Object

The right to object to a data subject’s data being processed is predominantly related to that of marketing functions.

National does not currently use customer data for marketing purposes.

Should a data subject exercise their right to object to processing for any other purpose, then as National requires data to allow the processing of repairs within the network and the provision of services at the point a data request is given the data subject will be informed that services can no longer be provided and will cease with immediate effect.

In addition, they will be informed that any warranty on repairs completed will be rendered null and void as the absence of data does not allow confirmation any repair was ever conducted.

The data subject can request this by following the ‘Accessing their rights’ section of this document. Upon receipt the request will be passed onto the National Claims Director for action. They will locate all correspondence and data relating to the data subject and note that the data subject has objected to further processing. In addition, they will contact the respective sub processor or partner who has been assigned any repair relating to the data subject to also cease processing of the data and make a note of such on their respective system.

Within 24hrs of a request being received the ‘data controller’ should be informed.

Confirmation that processing of data has ceased back to the data subject by National must be within 40 days from the date of when National receive back the ‘My data rights’ form.

Right Not to be Subject to Automated Decisions

Data subjects have the right to request that none of their data is party to automated decision making processes.

With relevance to the accident repair industry this may include such things such as automated decision making in respect of total loss assessments utilising AI (artificial intelligence).

Should a data subject exercise their right not to be subject to automated decisions and that process is part of the National service provision to that customer, then as National requires the automated decision-making process for the provision of services at the point a data request is given the data subject will be informed that services can no longer be provided and will cease with immediate effect.

The data subject can request this by following the ‘Accessing their rights’ section of this document. Upon receipt the request will be passed onto the National Claims Director for action. They will locate all correspondence and data relating to the data subject and note that the data subject has objected to automated decision making and if as per above is required for the provision of services, further processing and progression of the repair will cease.

Within 24hrs of a request being received the ‘data controller’ should be informed.

Confirmation that the data subject will not be party too automated decisions and back to the data subject by National must be within 40 days from the date of when National receive back the ‘My data rights’ form.

Right to Data Portability

All data subjects have the right to move their data under the right to data portability. This is to allow them to collect all the data stored on them and transport it simply to another service provider.
Upon receipt the request will be passed onto the National Claims Director for action. They will locate all data relating to the data subject and compile a CSV file containing same.

Once compiled the CSV file will be passed to the Data Subject by way of email, then will contact the National DPO to confirm all data has been ported to the data subject.

Within 24hrs of a request being received the ‘data controller’ should be informed.

The CSV file must be supplied to the data subject by National within 40 days from the date of when National receive back the ‘My data rights’ form.

Accessing their rights

Data subjects may request access to what information we hold on them initially by emailing mydata@national-arg.co.uk. The request is automatically passed to the National Data Protection Officer who will then forward to the data subject the ‘Managing My Data Form’ (see appendix 1).

The data subject will complete the form and submit either in hard copy format to the National Head Office address or via mydata@national-arg.co.uk.

Charges

There will be no charge detailed for accessing their rights under GDPR as per the current EU GDPR.

To discuss any of your requirements with one of our expert team please call 0330 1000 270 or email us at info@national-arg.co.uk