General Data Protection Regulation (GDPR) statement

GDPR applies to "personal data". This means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

GDPR applies to data processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.

We have prepared for the GDPR in the following ways:

1. Awareness
   Decision makers and key people within the MIDAS team are aware that the UK Data Protection law is changing to the GDPR.
2. Accountability
   We monitor compliance with data protection policies and regularly review the effectiveness of data handling / processing activities and security controls.
3. Information we hold
   We have documented what personal data we hold, where that data came from and who it is shared with.
4. Data Protection by Design and Data Protection Impact Assessments
   We have implemented appropriate technical and organisational measures to show we have considered and integrated data protection into our processing activities.
5. Data Protection Officers
   Our business has designated responsibility for data protection compliance to a suitable individual within the organisation.
6. Lawful basis for processing personal data
   Our business has reviewed the various types of information processing we carry out. We have identified our lawful basis for our data processing activities and documented this. Our business has explained our lawful basis for processing personal data in our privacy policies.
7. Consent
   Our business has reviewed how we seek, record and manage consent. Our business has reviewed the systems currently used to record consent and implemented appropriate mechanisms in order to ensure an effective audit trail.
8. Children
   Our business does not offer services directly to children.
9. Communicating privacy information
   Our business has reviewed our current privacy policies and has made any necessary changes in readiness for GDPR.
10. Individuals' rights
    Our business has checked our procedures to ensure that we can deliver the rights of individuals under GDPR.
11. Subject access
    Our business has reviewed our procedures and has plans in place for how we will handle requests from individuals for access to their personal data within the new timescales outlined in the GDPR. Our business has reviewed our procedures and has plans in place for how we will provide any additional information to requestors as required under the GDPR.
12. Data breaches
    Our business has appropriate procedures in place to ensure personal data breaches are detected, reported and investigated effectively. Our business has mechanisms in place to assess and then report relevant breaches to the UK Information Commissioners Office (ICO) where the individual is likely to suffer some form of damage, for example through identity theft or confidentiality breach. Our business has mechanisms in place to notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.
13. International
    We offer cloud hosted customers a choice of data centers for where their live MIDAS database will reside. This includes a European data center hosting option. Our hosting service provider is considered a "Data Processor" in relation to GDPR in accordance with Article 28 of the GDPR. The legal basis for such processing is covered by Article 6 (1)(f) of the General Data Protection Regulation (GDPR). Our hosting provider holds data in the highest regard and does not disseminate any customer uploaded data outside of its network. Data transfers to the US will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission. A copy of our hosting service provider's privacy policy ("Data Processing Agreement" for the purposes of GDPR) may be found here.

    We are a UK-based business, governed by the law of England and Wales, and are subject to the exclusive jurisdiction of the courts of England and Wales.