accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').
7. The controller shall be responsible for, and be able to demonstrate compliance with 1-6 above ('accountability')
WTCG complies with all of these principles both in the processing it currently carries out and as part of the introduction of new methods of processing such as new IT systems. The operation of an information security management system (ISMS) that conforms to the ISO/IEC 27001 international standard is a key part of that commitment. World Travel Centre Limited is currently aligning its ISMS processes with a view to being ISO 27001 compliant.
The data subject also has rights under the GDPR. These consist of:
The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.
Each of these rights must be supported by appropriate procedures within WTCG that allow the required action to be taken within the timescales stated in the GDPR.
These timescales are shown in Table 3.
All data collected and processed is necessary for a reason allowable in the GDPR. In the case of children below the age of 16 data is collected from a parent usually travelling in the same booking as the child.
This statement contains transparent information about our usage of personal data and is available to data subjects at any time, including rights regarding their data explained, such as the right to withdraw consent or have data permanently deleted.
We only collect data directly from the Data Subject or through a connected party such as an Employer or an entity contracting with us to supply travel services.
WTCG has adopted the principle of privacy by design and will ensure that the definition and planning of all new or significantly changed systems that collect or process personal data will be subject to due consideration of privacy issues, including the completion of one or more data protection impact assessments.
12 | Page