Data Protection Terms of Reference
In full compliance with the rules on personal data protection (EU Regulation No. 2016/679), Valley Hearing invites you to read the following information notice to understand how it will process your personal data, which may be acquired:
· Directly: at the time of the hearing aid visit or during the pre-sale or purchase of a product
· Indirectly: based on information provided by you actively using a purchased product
1. MODES OF PROCESSING
Valley Hearing receives and processes your data with respect and care.
The personal data provided by you will be processed by Valley Hearing on paper, computer or electronic media.
Of the received data, Valley Hearing Ltd will handle:
• its exact recording, so that it corresponds to what you have declared;
• the updating of each variation notice;
• the storage in a form that allows your identification for a period of time no longer than necessary for the purposes for which it was collected.
2. PURPOSES OF THE PROCESSING
"We ask for your data to offer you the best solution for your hearing profile"
The data you provide when participating in pre-sales consultations, by filling out forms at the Branch during your visit, when purchasing one of the products or by using one of the products, will be processed for the following purposes:
· MANDATORY : (legal bases: (i) processing necessary for the execution of a contract (ii) processing necessary to fulfill a legal obligation of the Data Controller)
a) allow the execution of pre-contractual information activities, including a hearing test, equipment testing, and fulfilling contractual obligations arising from the sale of products, including those related to after-sales support services, also by reading and processing the information automatically stored by the hearing aids (see paragraph 6 below); fulfill obligations in accordance with applicable laws or regulations or to respond to instructions issued by the competent authorities/supervisory and control bodies
· OPTIONAL: (legal basis: your consent)
b) carry out promotional activities, which may also include sales communications, advertising material, direct sales, market research and monitoring the degree of satisfaction of the concerned person with products marketed by Valley Hearing through conventional contact methods - by post or phone - and automated methods - such as SMS, WhatsApp, email or phone calls;
c) carry out sales profiling activities (see following paragraph 6, subparagraph b) Valley Hearing reserves the right to remove the received data from its archives, if, when checked, the data turns out to be incorrect, incomplete or outdated.
In addition, preserving your anonymity and for the same purposes, Valley Hearing Ltd will be able to use all the data provided for statistical purposes.
The provision of personal data requested by Valley Hearing is optional. However, failure to provide the data for purposes:
· of a mandatory nature: would not allow you to establish any relationship with Valley Hearing Ltd, to carry out the hearing assessment and provide you with additional warranty or maintenance services for the products marketed by Valley Hearing Ltd.
· of an optional nature: it would not allow you to receive useful and advantageous promotions on our products or to customise your experience according to your specific individual needs.
3. TYPE OF DATA PROCESSED
"To process the sensitive data contained in your audiogram or in other medical documentation provided to us, we ask for your explicit consent, which you can revoke freely and at any time"
Valley Hearing Ltd requests the following data to be able to provide the best services for your hearing:
· Common data (identifiers): this is the data that allows us to identify you directly (name, surname, date of birth, National Insurance number etc.)
· Particular categories of data (so-called sensitive): this is the data that could reveal your state of health, particularly with regard to your hearing ability.
In order to process your sensitive data, we request your explicit consent, also for the purposes of a mandatory nature above. This consent is freely revocable at any time, without prejudice to the lawfulness of the processing performed before the revocation. The withdrawal of consent can be communicated to us in writing.
4. SCOPE OF THE CIRCULATION OF THE DATA
"Your data will be processed by as few people as possible, specifically authorised by Valley Hearing Ltd"
To achieve the purposes described in paragraph 2 above, the personal data may circulate in the following areas:
A. Scope attributable to Valley Hearing Ltd - Your data may be used by employed or contracted staff of Valley Hearing Ltd:
a. who has been assigned a specific role of Data Manager or;
b. who has been given adequate instructions;
c. also bound by a duty of confidentiality.
Your personal data will be made accessible only to persons within the company who need it to do their work. Such persons are appropriately trained in order to avoid any loss, destruction, unauthorised access or unauthorised processing of the data.
Furthermore, the data may be used by third-party companies carrying out ancillary activities on behalf of Valley Hearing Ltd, such as:
· External consultants for legal assistance and advice in managing any dispute;
· Service companies (including IT): debt collection companies, companies for invoice management and archiving, entities providing services for the management of IT systems, entities performing data entry, cloud system providers, etc;
· Public bodies or authorities and supervisory and control bodies that receive communications from Valley Hearing Ltd and, more generally, public or private persons in their role as public officers or public service representatives;
· Companies of the same group as the Data Controller, for administrative/accounting or archiving purposes.
The above persons act as external processing supervisors and under the direction and supervision of Valley Hearing Ltd.
5. DATA DISSEMINATION
"Your data will never be disseminated"
Your personal data will never be published, displayed or made available to indeterminate persons.
6. PROFILING
"Your data will not be subjected to fully automated decisions"
Valley Hearing Ltd does not subject your data to fully automated decisions, which produce legal effects that concern you or that significantly affect your person, but collects and analyses, through the intervention of staff tasked with and trained for processing the data you supplied also through the normal use of the hearing device, in order to:
a. provide an optimal personalisation based on your real life habits and needs, on the noise of the environments that surround you, and that takes into account the interference with other factors that may affect the performance of our products (mandatory purposes).
As an example:
• data regarding your use of the hearing aid (hours per day) will provide our audiologist with an effective tool to monitor your progress and to give you better suited advice, thus improving your hearing experience.
• if the collected data should highlight a frequent use of the hearing aid in environments with background noise covering speech (restaurant, public place), our audiologist could fit your hearing aid in order to increase the filter function, giving you better understanding of speech even in noisy environments.
b. carry out an analysis of your behavior, preferences and habits, so as to allow the Data Controller to carry out promotional activities that are more in line with your individual needs. (optional purposes).
As an example, if the collected data shows that you habitually raise the volume on the hearing aid while watching TV, your audiologist can suggest the purchase of a device that links the TVs audio signal directly with the hearing aid, thus enabling you to hear the TV better.
7. DATA RETENTION
"Your data will be kept for the time necessary to sell Valley Hearing products and for the preliminary and ancillary activities, together with related product promotion activities"
The personal data that you have provided us will be kept for a period of time not exceeding the achievement of the purposes:
· of a mandatory nature: corresponding to the duration of the contractual relationship with you, to which we may add the time necessary to ensure our legal protection also in respect of your possible heirs, and to fulfill the traceability obligations required by UK legislation regarding medical devices.
· of an optional nature: personal data processed for sales communication purposes and any profiling will be processed for no more than is necessary from the issue of consent and/or last purchase/trial, given the particular type of products and services offered by Valley Hearing Ltd and the continuous assistance relationship that is established with the Customer, whom is guaranteed the possibility of revoking at any time their consent without prejudice to the lawfulness of the processing before revocation.
8. RIGHTS OF DATA SUBJECT
"You have the right to request from Valley Hearing, access, portability and deletion of your data, in addition to the limitation of and opposition to the processing"
In relation to the processing of your personal data, you have the right to request from Valley Hearing Ltd:
· Access: you can ask for confirmation of whether or not data that relates to you is being processed, as well as more clarifications about the information referred to in this information notice.
· Correction: you can request to correct or supplement the data provided to us, if inaccurate.
· Deletion: you can request that your data be deleted, if it is no longer necessary for our purposes, in case of revocation of consent or your opposition to the processing, in case of unlawful processing, or if there is a legal obligation to delete it.
· Limitation: you can request that your data be processed only for the purpose of storage, excluding any other processing, for the time necessary to correct your data or in case of unlawful processing for which you are opposed to the deletion or if you have to exercise your rights in court and the data stored by us may be useful or, finally, in case you opposed the processing and the verification of the prevalence of our legitimate rights over yours is being carried out.
· Objection: you can object to the processing of your data at any time, unless there are legitimate reasons for proceeding with the processing that prevail over yours, for example for the exercise of a right or our defence in court.
· Portability: you can request to receive the data you provided, or to send it to another Data Controller indicated by you, in a commonly used structured format readable by automatic device. In addition, we inform you that in case of failure or partial fulfillment by the Data Controller of the aforementioned requests, you will have the right to submit a complaint or appeal to the Supervisory Authority, which is the Information Commissioners Office.
At any time you can exercise your privacy rights towards Valley Hearing Ltd without any formalities, including through an authorised third party with a specific power of attorney, communicating by:
registered letter:
Valley Hearing Ltd, 26 Cardiff Road, Caerphilly, CF83 1JP
email: support@valleyhearing.co.uk
9. DATA CONTROLLER, DATA SUPERVISORS AND DPO
The Data Manager at Valley Hearing Ltd is the Managing Director Mr J McCarthy.