2.12 Addressing Compliance to the GDPR

The following actions are undertaken to ensure that WTCG complies with the accountability principle of the GDPR:

The legal basis for processing personal data is clear and unambiguous

All staff involved in handling personal data understand their responsibilities for following good data protection practice

Training in data protection has been provided to all staff

Where applicable, Rules regarding consent are followed

Routes are available to data subjects wishing to exercise their rights regarding personal data and such enquiries are handled effectively

Regular reviews of procedures involving personal data are carried out

Privacy by design is adopted for all new or changed systems and processes. The following documentation of processing activities is recorded:

• oOrganization name and relevant details

Purposes of the personal data processing

• oCategories of individuals and personal data processed
• oCategories of personal data recipients
• oAgreements and mechanisms for transfers of personal data to non-EU countries including details of controls in place
• oPersonal data retention schedules
• oRelevant technical and organisational controls in place

These actions will be reviewed biannually as part of the management review process of the information security management system.

2.13 Data Deletion

Hard Copy Data.

We aspire to operate as a paperless business. We do however receive some paper records from third parties and these may contain personal data. All paper documentation is shredded and disposed of.

Soft Copy / Electronic Data.

Subject to the data retention policy set out in table 2 below, we have a thorough and complete approach to deleting data from all data sources including but not limited to database tables, temporary files, log files and any other locations where personal data may exist.

Page