Interpretation

Krysalis Consultancy Ltd acts as a data processor in line with the definitions in the regulation. We are not involved in the large-scale processing of personal data. Personal Data is used only to provide a designated service and not for large-scale data processing activities.
The Company is not required to appoint a Data Protection Officer, however, because the data we hold comes under the special category defined by ‘sensitive personal data’, the Company has appointed a voluntary Data Protection Controller to ensure that minimum tasks under the DPA are adhered to.

For all matters relating to data protection please contact Krysalis Consultancy Ltd by using the email address: This email address is being protected from spambots. You need JavaScript enabled to view it. or, alternatively, call 01722 466117.

We take data protection seriously and are fully cognisant of, and compliant with, both GDPR and PECR. We are registered with the ICO as Data Processors (Registration Number ZA164687).

Definition of personal data

Personal data is information that relates to a living individual who can be identified from the information and which affects the privacy of that individual, either in a personal or professional capacity. Any expression of opinion about the individual or any indication of the intentions of any person in respect of the individual will be personal data.

Provided the information in question can be linked to an identifiable individual (data subject), the following are likely to be examples of personal data:

  • an individual’s salary or other financial information
  • information about an individual’s family life or personal circumstances, health needs, employment or personal circumstances, any opinion about an individual’s state of mind
  • sensitive personal information – an individual’s racial or ethnic origin, political opinions, religious beliefs, physical or mental health, sexual orientation and criminal record.

 Information we collect 

The personal data we hold has been obtained direct from the data controller or data subject.

We collect and process data that includes personal identifiable information and information of a sensitive nature including name, date of birth, home and email address. We collect information about medical history and details relating to personal identity.

Where we are requested to provide a service to a beneficiary we may collect and process any of the following information:

  • full name
  • gender
  • date of birth
  • address
  • email address
  • telephone number
  • NHS number
  • hospital number
  • details of referring parties including, insurer, solicitor and Case Manager
  • occupation
  • litigation friend details
  • next of kin (NOK) details
  • hospital / GP details
  • accident circumstances.

We may collect video footage and photographs, however, these will only be collected and retained following signed consent from the data controller.

Sub-processors

In line with the regulation, we are required to inform you of any other processors involved in the processing of your personal data. We have sought and have recorded assurances from other processors, where they are used; and they are as follows:

Microsoft We use Microsoft Office 365 to store information relating to a staff member, beneficiary and referrer. https://www.microsoft.com/en-us/trustcenter/privacy/

iinsight We use iinsight to store and manage information relating to a beneficiary and referrer. http://www.iinsight.biz/information-security.php

Qunote We use Qunote to store and manage information relating to a beneficiary and referrer. http://www.qunote.com/case-management-software-features/data-security/

PeopleHR We use PeopleHR to store and manage information relating to a staff member. https://www.peoplehr.com/gdpr.html

Dropbox We use Dropbox for some project related information. https://www.dropbox.com/en_GB/security/GDPR

Purpose of processing and the legal basis for processing 

We process data to plan and implement the service, to improve service delivery and to measure the effectiveness of the service. We use data to record information for equality and diversity audits and to support compliance with all regulatory requirements. We use personal data to maintain staff and beneficiary safety.

We use data for marketing and promotion of the service and to share information and knowledge relevant to the service provided. We do not engage in profiling or automated decision making.

Data processing safeguards

We have data processing safeguards in place to support our service. A full outline of all of our data processing activities can be seen within our Data Protection Policy and GDPR risk assessment.

In summary;

  • Our day-to-day working practices and culture support good governance in relation to data protection.
  • Training, education and supervision is offered to all staff in relation to data protection.
  • Our electronic systems are structured in a way so to reduce the risks associated with managing personal information.
  • We routinely audit working practices.
  • We only utilise software from accredited sources.
  • We only work with companies who can demonstrate a commitment to data protection.
  • We ensure that all devices are protected from online threats.
  • We use software firewalls and TSL encrypted emails hosted by a Microsoft exchange server to protect data.
  • Our website has an SSL certificate and, therefore, adheres to industry standards for online website safety and security. We do not store any personal identifiable information on our website.

Details of transfers to third country and safeguards

We do not sell or transfer data onwards to other recipients, nor do we transfer data to third countries or international organisations.

Retention period or criteria used to determine the retention period

We collect data in order to provide quotes to prospective referrers and to fulfil service and contractual requirements. This information may be retained for up to 7 years for financial recording reasons as required by regulators. Further, data may be retained for the purposes of client and beneficiary communication, the marketing of services / sharing of information relevant to the service and for regulatory or legal defence reasons until such time as these details would no longer be relevant or required. If this contractually necessary information is not retained and provided we will be unable to satisfactorily communicate with referrers and beneficiaries, and so would be unable to act effectively on any requests from such individuals.

Where we are requested to provide a service to a beneficiary we are required to produce and retain clinical records. In relation to retaining clinical records the Company’s insurance policy states that it is a condition of the Insurance Policy to take and retain client records. The policy wording notes; ‘The records shall be kept for at least 7 years following the last occasion on which treatment was given. In the case of treatment to minors, it is advisable that records should be kept or at least 7 years after they reach the age of maturity (18).’ Record Keeping - Condition 14 c, on page 35

The Statute of Limitation in the UK (i.e. the time when an individual is able to bring a claim) is 6 years for certain injury claim situations, or 6 years after the individual reaches the age of maturity in the case of minors. However, these 6 years start from the date that the injury was discovered and not from the time that the alleged incident that caused it occurred. There are also instances, for example if treating a vulnerable client, where the statute may be overturned.

Due to the nature of the work undertaken by the Company our policy states that clinical records will be retained for 10 years after the beneficiary’s death. However personal identifiable data found within our electronic data management system is removed within 6 months of a case being closed. There are provisions under the GDPR with regards to keeping records in a claim situation. This guidance clearly gives the right to retain data to comply with insurance Terms and Conditions, should an individual make a request for them to be deleted under their Right of Erasure.

The existence of each of data subject’s rights

Data subjects have the right to request objection, access, deletion, alteration, restriction of processing, withdrawal of consent, and data portability. To exercise these rights data subjects should contact us using the details provided above.

Data subjects also have a right to raise a complaint with the UK supervisory authority (the ICO); their contact details can be found online.

Data subjects have a right to withdraw consent at any time, where relevant.

Information about other products and services

From time to time we may send you information about Krysalis Consultancy Ltd and our products and services which we think may be of interest to you.
You can tell us to stop this at any time by sending an email to This email address is being protected from spambots. You need JavaScript enabled to view it. or by using the opt-out facilities available.

Changes To Your Details

We work hard to keep our information about you as accurate as possible. If you would like to review or change the details you have supplied us, please contact us on This email address is being protected from spambots. You need JavaScript enabled to view it. or, alternatively, call 01722 466117.

Information automatically collected from your computer

Cookies

Cookies are small files transferred to your computer’s hard drive through your web browser. They are widely used in order to make websites work, or to work more efficiently, as well as providing information to the owners of the site.

This site uses essential cookies to store temporary information during your visit. It also uses cookies from Google Analytics and Vimeo.

The cookies used on this site are:

Statistic Cookies

Cookie Name: @@History/@@scroll|#
Expiry: Persistent
Purpose: Unclassified


Cookie Name: _ga
Expiry: 2 years
Purpose: Registers a unique ID that is used to generate statistical data on how the visitor uses the website.


Cookie Name: _gat
Expiry: Session
Purpose: Used by Google Analytics to throttle request rate


Cookie Name: _gid
Expiry: Session
Purpose: Registers a Unique ID that is used to generate statistical data on how the visitor uses the website


Cookie Name: collect
Expiry: Session
Purpose: Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.


Cookie Name: vuid
Expiry: 2 years
Purpose: Collects data on the user's visits to the website, such as which pages have been read.

Marketing Cookies

Cookie Name: _atuvc
Expiry: 1 year
Purpose: Updates the counter of a website's social sharing features


Cookie Name: _atuvs
Expiry: Session
Purpose: Ensures that the updated counter is displayed to the user if a page is shared with the social sharing service, AddThis.


Cookie Name: at-lojson-chache-#
Expiry: Persistent
Purpose: Used by the socual sharing platform AddThis


Cookie Name: bkdc
Expiry: 179 days
Purpose: Registers anonymised user data, such as IP address, geographical location, visited web sites, and what ads the user has clicked , with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.


Cookie Name: bku
Expiry: 1 year
Purpose: Unclassified


Cookie Name: bku
Expiry: 179 days
Purpose: Registers anonymised user data, such as IP address, geographical location, visited web sites, and what ads the user has clicked , with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.


Cookie Name: di2
Expiry: 1 year
Purpose: Unclassified


Cookie Name: DotomiUSer
Expiry: 1 year
Purpose: Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.


Cookie Name: dtm_test
Expiry: Session
Purpose: Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.


Cookie Name: loc
Expiry: 1 year
Purpose: Geolocation, which is used to help providers determine how users who share information with each other are geographically located (state level).


Cookie Name: mus
Expiry: 1 year
Purpose: Unclassified


Cookie Name: ouid
Expiry: 1 year
Purpose: Unclassified


Cookie Name: SEUNCY
Expiry: 179 days
Purpose: Registers a unique ID that identifies the user's device for return visits


Cookie Name: TapAd_DID
Expiry: 2 months
Purpose: Used to determine what type of devies are used by a user


Cookie Name: TapAd_TS
Expiry: 2 months
Purpose: Used to determine what type of devies are used by a user


Cookie Name: uid
Expiry: 1 year
Purpose: Creates a unique, machine-generated user ID. Add This, uses
the user ID to make it possible for the user to share content across social networks and provide detailed statistics to various providers.


Cookie Name: uuid
Expiry: 1 year
Purpose: Collects dtata on the user's visits to the website, such as what pages have been loaded. The registered data is used fo targeting ads.


Cookie Name: UUID#[abcdef0123456789]{32}
Expiry: Session
Purpose: Unclassified


Cookie Name: uuidc
Expiry: 1 year
Purpose: Collects dtata on the user's visits to the website, such as what pages have been loaded. The registered data is used fo targeting ads.


Cookie Name: uvc
Expiry: 1 year
Purpose: Detects how often the social media sharing service, AddThis, encounter the same user.


Cookie Name: vc
Expiry: 1 year
Purpose: Used by the social media sharing service, AddThis.


Cookie Name: xtc
Expiry: 1 year
Purpose: Registers the user's sharing of content via social media.

 

Information automatically collected from your computer

Log files/IP address: When you visit the Site our web server automatically records your IP address. This IP address is not linked to any of your personal information. We use IP addresses to help us administer the Site and to collect demographic information for aggregation purposes.

We may also gather non-personal information (from which we cannot identify you) such as the type of your internet browser which we use to provide you with a more effective service.

Security

The internet is not a secure medium. However, we have implemented technology and policies to safeguard your privacy from unauthorised access and improper use.

Linking to third party websites

We cannot be responsible for the privacy policies and practices of other sites, even if these Sites have been accessed using links from our Site. We recommend that you check the policy of each site you visit and contact the organisation concerned if you have any questions.

If you linked to our Site from a third party site, we cannot be responsible for the privacy policies and practices of the owners or operators of that third party site and recommend that you check the policy of that third party site and contact the organisation concerned if you have any questions.

Speak to an expert

Call today on 01722 466117