The National Business Crime Solution Ltd (“the NBCS” “We”, “Us” “Our”) take the protection of data seriously. Our service is not possible without Processing Personal Data. We shall always be compliant with the UK General Data Protection Regulation (UK GDPR) and UK specific legislation applicable to the NBCS processing. We are a registered Controller with the Information Commissioner’s Office (ICO) with registration number ZA072300.
The purpose of this privacy notice to is to explain what Personal Data we process, why we do it and how and to let individuals know what their rights are in relation to that Personal Data processing.
This privacy notice is based on the terms contained within the UK GDPR but for ease of understanding the following definitions apply.
Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
Data Subject: any identified or identifiable natural person, whose Personal Data is processed by the Controller responsible for the Processing.
Member: any business that subscribes for a membership at the NBCS.
Personal Data: any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processor: a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller.
Third Party: a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor and persons who, under the direct authority of the Controller or Processor, are authorised to process Personal Data.
Restriction of Processing: the marking of stored Personal Data with the aim of limiting their Processing in the future.
Processing: any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Profiling: any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
Special Category Data: any Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
The information We collect about you when you visit Our website
When you request one of Our web pages through your browser, data such as:
your IP address, your browser and the version you’re using, your operating system and the date and time and site you came from are collected by cookies and stored in a log file and/or a database.
But don’t worry – this information can’t be used to identify specific individuals, and we only use it for managing and maintaining Our website research and development of Our products and services and anonymous user analysis, so we can see how Our site’s being used.
Our reasons for Processing Personal Data
We process Personal Data, Special Category Data and criminal offence data for the prevention and detection of crime and anti-social behavior. We also use this data to identify natural persons for further action such as, following up on an investigation, police support, exclusion notices, civil court injunctions, private prosecutions and protecting Our Members and their employees. Our overall aim in Processing this Personal Data is to prevent and reduce crime and enhance national prosperity at the local, regional and national level.
We collect information relating to the above reasons/purposes from the following sources:
UK law enforcement bodies, Our Members, Business Improvement Districts, UK crime partnerships, open source material via social media and any other relevant bodies or businesses linked to ongoing criminal investigations.
Types of Personal Data we process for the above reasons/purposes may include:
- Name and address details
- Images taken from CCTV
- Video taken from CCTV
- Date of birth, age and descriptive details such as tattoos, facial hair, scars, noticeable characteristics, eye colour, hair colour, height, build, clothing, piercings, glasses
- Email address
- Phone number
- Details of associates
- Vehicle registration details
- Records of correspondence
We also process Special Category Personal Data and other more sensitive categories of Personal Data such as:
- Race and/or Ethnic origin
- Details of suspected criminal offences
- Details of criminal convictions or offences or related information including location data and place of offence
- Details of civil actions taken against individuals
We process Personal Data about Our:
- Members’ employees
- complainants and enquirers
- advisers and other professional experts
- Members’ individuals of interest
What do we do with the Personal Data we collect?
Our Members are national, regional and independent retailers, transport and distribution companies, Business Improvement Districts and Business Crime Partnerships. All Members of the NBCS have a mutual legitimate interest.
Where an individual has been reported by a Member of the NBCS for direct or suspected direct involvement in an incident which represents a threat to a Member of the NBCS, its customer, or the wider community, the NBCS will process the Personal Data of that individual.
We will process the Personal Data in multiple ways in order to achieve Our purpose, including;
- We will store the Personal Data on Our secure database.
- We may match the Personal Data to similar patterns of offending to identify the true scale of the issue and whether an individual is a repeat offender.
- We may pass a series of offending to the police for further investigation and or action.
- Where appropriate, We will share Personal Data with our Members for the purpose of alerting them to potential threats to their businesses and for the prevention and detection of crime. The Personal Data shared may include any of the categories listed above but, in each case, will be limited to what is necessary for this purpose and will only be shared where it is relevant according to geographical area and type of industry.
- The Personal Data may also be used to support civil outcomes such as civil court injunctions and banning notices.
Rights of the Data Subject
The UK GDPR affords Data Subjects with rights. These rights are summarised below. In order to exercise any of these rights, the Data Subject may contact NBCS at any time, using the details given below under ‘Contact Us’.
Right of access: Each Data Subject shall have the right to obtain from the Controller, information about his or her Personal Data stored at any time and a copy of this information.
Right to rectification: Each Data Subject shall have the right to require the Controller without undue delay to rectify any inaccurate Personal Data concerning them. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
Right to erasure (Right to be forgotten): In some circumstances a Data Subject shall have the right to compel the Controller to erase Personal Data concerning them without undue delay.
Right of restriction of Processing: Data Subjects have the right to compel the Controller to restrict the use of Personal Data if it is inaccurate, has been used unlawfully (but the Data Subject does not want the Controller to delete it), where it is not needed any more for the purpose for which it was collected or if the Data Subject has already objected to the processing and confirmation from the Controller as to whether they can comply with the request is pending.
Right to data portability: In some circumstances a Data Subject shall have the right to receive the Personal Data concerning him or her, which was provided to a Controller, in a structured, commonly used and machine-readable format.
Right to object: A Data Subject shall have the right to object to the processing of their personal data where for purposes of direct marketing or where the lawful basis relied upon is “legitimate interests” or “public task”.
Automated individual decision-making, including profiling: Each Data Subject shall have the right not to be subject to a decision based solely on automated processing, including profiling. The NBCS does not make decisions based solely on automated processing.
Right to Withdraw Consent: Where the NBCS rely on consent as the lawful basis for processing Personal Data, a Data Subject has the right to withdraw their consent at any time. Please note that the NBCS does not rely on consent for any processing of Personal Data. Our lawful basis for the processing of data is legitimate interests.
Right to complain to the Information Commissioner’s Office (ICO) – The contact details for the ICO are contained at the bottom of this Privacy Notice.
You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
The NBCS lawful basis for processing this data is “legitimate interests” as the Processing is necessary to protect the business interests of Our Members and there is no less intrusive way to achieve those business interests. This legitimate interest is not outweighed by the rights and freedoms of the affected individuals as Our Processing is for the greater public interest, the benefit of the NBCS and its Members.
Where we process Special Category Data, we do so on the basis that it is in necessary for reasons of substantial public interest, in accordance with Article 9 (2) (g) of the UK GDPR. We have assessed this interest against the appropriate provisions within the Data Protection Act 2018 (DPA 2018) and consider that Our Processing is necessary for the purpose of preventing or detecting unlawful act, in accordance with paragraph 10, schedule 1 of Part 2 of the DPA 2018.
Period of storage
Personal Data is held for 25 months before its permanently and securely disposed of. The secure disposal of Personal Data is an automated process. All Personal Data is held on UK based secure servers.
Who do We share your Personal Data with?
The NBCS act as the Controller and any sharing is conducted under information sharing agreements with UK law enforcement bodies, it’s Members, Business Improvement Districts, UK crime partnerships and any other relevant bodies or businesses linked to ongoing criminal investigations, or for the purpose of analysing such data to further investigations into cross company, cross police force, prolific and persistent offenders. The NBCS does not share Personal Data outside of the UK.
We also use Third Party Processors to process data on our behalf. We enter into Data Processing Agreements with these Processors to ensure that they only process the data under our strict instructions.
Security of processing
As the Controller, the NBCS has implemented appropriate technical and organisational measures to ensure Personal Data processed remains secure.
Concerned about how We handle Personal Data?
If you are concerned about the way in which we process your Personal Data, you can contact the ICO via https://ico.org.uk/concerns or tel: 0303 123 1113
If you wish to exercise your rights or if you wish to contact us for any other reason, please use the contact details below.
The name and address of the data Controller is:
National Business Crime Solution Ltd, 4 Dukes Court, Bognor Rd, Chichester, England, PO19 8FX
Changes to this notice
This notice was last updated on 13/12/2021 We may update this notice to reflect changes in the law or Our privacy practices.