1. POLICY OBJECTIVES

The objective of this policy is to ensure that:

• proper procedures are in place for the processing and management of personal data
• individuals are assured that their personal data is processed in accordance with the data protection principles, that their data is secure at all times and safe from unauthorised access, alteration, use or loss
• all staff understand their responsibilities when processing personal data, and that methods of handling that information are clearly understood
• there is an appointed specialist within the organisation who has specific responsibility and knowledge about data protection compliance
• data subject access requests are dealt with promptly

2. BACKGROUND

The General Data Protection Regulation 2018 (GDPR) sets six principals which govern how personal data is collected, held and processed by organisations. The GDPR has two aims:

• to regulate the use by those (known as data controllers) who obtain, hold and process personal data on living individuals; and
• to provide certain rights (for example, of accessing personal data) to those living individuals whose data is held.

Failure to comply with the GDPR can lead to a fine up to 4% of the group’s annual turnover, or EUR 20m, whichever is higher, for serious breaches.

NAM UK will process personal data in the normal course of our business activities and will therefore be a Data Controller. Data controllers are required to appoint a DPO who is responsible for the administration of a data protection policy and providing guidance on data protection issues. All NAM employees, contractors and temporary workers (“NAM UK staff”) must comply with any directions that the DPO may give to them and any guidelines issued from time to time regarding the processing of personal data.

3. PRINCIPLES

In summary, the 6 Data Protection Principles are:

1. Personal data shall be processed fairly, lawfully and in a transparent manner.

2. Personal data shall be collected only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with those purposes.

3. Personal data shall be adequate, relevant and not excessive in relation to the purpose(s) for which they are processed.

4. Personal data shall be accurate and, where necessary, kept up to date.

5. Personal data processed for any purpose(s) shall not be kept for longer than is necessary.

6. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, personal data.

4. DATA

4.1 Data

The GDPR applies to data held on computers and hard-copy data, such as paper files, which are structured either by reference to individuals or to criteria relating to individuals where that personal data is readily accessible.

4.2 Personal Data

Personal data means any information that can identify a living individual (”data subject”) and includes:

• name
• address
• email
• phone number
• date of birth
• national insurance number, etc.

4.3 Sensitive Personal Data

All references to personal data shall include sensitive personal data which is a sub-set of personal data and consists of the following information:

• racial or ethnic origin
• political opinions
• religious beliefs or other beliefs of a similar nature
• membership of a trade union
• physical or mental health
• sexual life
• the commission, or alleged commission of, any offence
• any proceedings for any offence committed or alleged to have been committed and the outcome of such proceedings

Sensitive personal data does not include financial records or other information that individuals may regard as private or confidential.

5. PURPOSES FOR WHICH PERSONAL DATA MAY BE PROCESSED

NAM UK collects personal data for two main purposes:

5.1 Personal Data about You

Personal data will be collected about you that is required for the operation of this website, but only to the extent required by law.

5.2 Personal Data Collected About Other Parties

Personal data should be processed fairly and lawfully for the intended purpose for which it is collected.

6. DISCLOSURE, SECURITY AND RETENTION OF PERSONAL DATA

6.1 Disclosure of Personal Data

Personal data may be transferred to NAM UK’s group companies, regulators, law enforcement agencies, benefit and pension providers, healthcare providers and other companies engaged in contractual or legal activities on NAM UK’s behalf.

NAM UK will not share personal data unless there is a lawful reason or obligation for doing so.

6.2 International Data Transfers

NAM UK conducts its business activities on a global basis. Personal data will only be transferred outside of the EEA where the Company is satisfied that the third party receiving the information has sufficient security measures in place to collect, handle and process the personal data securely.

NAM UK will only transfer data internationally where it has an agreement in place with the other party that states that they protect personal data in accordance with the GDPR.

6.3 Security of Personal Data

NAM UK takes appropriate technical and organisational measures to ensure the security of personal data that it processes. Only authorised and trained individuals are permitted to access personal data.

Access to certain personal data will only be granted to specified data users within NAM UK for specific and legitimate purposes.

6.4 Retention of Data

NAM UK will not keep personal data for longer than necessary to achieve the purposes for which the information was collected and will dispose of such data safely and securely.

7. DATA SUBJECT ACCESS REQUESTS

A data subject has the right under the GDPR to request access to the records held by a Company about them. Requests must be made in writing and sent to the DPO. Under the GDPR, a Company cannot charge for the provision of such information. The Company has up to 30 days to provide the personal information.

7.1 NON-DISCRIMINATION

NAM UK will not discriminate against an individual for the amount of personal data they provide and their service will not be affected by exercising their data subject rights.

8. CONFIDENTIALITY

All personal data processed within NAM UK is confidential. Furthermore, all NAM UK staff are required to comply with NAM UK’s Confidentiality Policy and Procedures and Nomura Group Code of Conduct.

NAM UK staff must not, except where authorised by the DPO, obtain or disclose personal data, or procure its disclosure to anyone else, without the consent of the person or body having legal responsibility for such data.

When dealing with information about other individuals (including when writing about someone in an email or other documents) all NAM UK staff should bear in mind that all personnel, as well as clients and others, may have the right to access data relating to themselves that the Company holds. Personal data should not be collected and/or processed if the subsequent release of that information may give rise to embarrassment and/or liability on the part of the Company or any personnel, or may bring the Company’s name or that of any personnel into disrepute.

9. OTHER INFORMATION

Information about your right to object under Article 21 of the General Data Protection Regulation (GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (f) of Article 6(1) GDPR (processing to pursue legitimate interests not overridden by the Data Subjects’ interests).

If you object, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Objections do not have to follow any particular form and should ideally be sent via e-mail to: [email protected]