Data Protection and IT Security

Part 1

Privacy notice

This notice explains what personal information we collect, why we need it, who we share it with, how long we keep it and the rights you have. It applies to our customers, people who contact us, visitors to our yard and our suppliers.

Who we are

J&M Storage Systems Ltd is a trade supplier of new and used warehouse equipment, trading since 1985. We are registered in England and Wales under company number 01913962, and our registered office and trading address is Unit 2, Northside Industrial Estate, Whitley Bridge, Nr Goole, DN14 0GH. We are the controller of the personal information described in this notice, which means we decide how and why it is used.

We handle personal information in line with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

The information we collect

We only collect what we need to quote, sell, deliver and collect equipment, and to run a safe site. We do not collect special category information such as health, biometric or religious information, and we do not ask for copies of identity documents.

Why we use it and our lawful basis

We do not sell personal information, and we do not make decisions about people by automated means.

Who we share it with

We share information only where it is needed and only with organisations that are required to keep it safe. These are our accountants, who receive a copy of our accounts data to prepare our accounts and tax returns; our IT support provider, Leeds IT Services, which manages our email and IT systems and may see information while doing so; the providers of the software we use, including Sage for accounts and Microsoft for email and documents; our card payment provider; carriers who deliver or collect equipment, who receive the delivery name, address and phone number; and our insurers, legal advisers, the police or HMRC where we are legally required or entitled to share it.

Some of our software providers store data in data centres outside the UK. Where that happens, the transfer is protected by UK adequacy regulations or approved contractual safeguards.

How long we keep it

When records reach the end of their retention period they are deleted from our systems, and paper records are shredded.

Your rights

You have the right to ask for a copy of the personal information we hold about you, to have anything inaccurate corrected, to ask us to delete it or restrict how we use it, to object to us using it where we rely on legitimate interests, to stop any marketing, and in some cases to receive it in a portable format. To make a request, contact us using the details above. We will reply within one month. There is no charge in most cases, and we may ask you to confirm your identity before we release anything.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. We will acknowledge your complaint within 30 days, look into it properly and tell you the outcome without undue delay. If you remain unhappy, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We review this notice every year and whenever the way we use information changes. The version and date at the top of this page show when it was last updated.

Part 2

CCTV

We use CCTV in and around our yard. Anyone visiting the site, including customers collecting equipment and delivery drivers, may be recorded.

The cameras are there to protect people working on and visiting the site, to prevent theft and damage to stock and vehicles, and to help us deal with accidents, disputes and insurance claims. Cameras cover the yard, entrances and buildings. They do not point at neighbouring homes, and they do not cover toilets or rest areas.

Signs at the site entrance tell visitors that CCTV is in use. Recordings are kept on a secured recorder that only authorised staff can access. Footage is overwritten automatically, normally within 30 days. We only keep it longer when it is needed for an incident, a claim or a request from the police, and we keep it only for as long as that matter needs.

If you believe you have been recorded, you can ask for a copy of the footage by contacting us with the date, approximate time and a description of yourself. Where other people can be identified in the footage, we may need to blur them before releasing it.

Part 3

IT security policy

These are the rules everyone working for J&M Storage Systems follows when using company computers, phones, email and systems. They apply to directors, employees, temporary staff and anyone else given access to our systems.

Accounts and passwords

1. 3.1Every person has their own user account. Accounts and passwords are never shared, including with colleagues.
2. 3.2Passwords must be at least 12 characters long. A passphrase of three or four unrelated words is easier to remember and harder to guess. Work passwords must not be used for any personal account.
3. 3.3Passwords are stored in the company password manager provided by our IT support provider, not written down, saved in documents or kept in a browser on a shared computer.
4. 3.4Multi factor authentication must be switched on for every Microsoft 365 account and any other system that offers it, including remote access, banking and the accounts system where available. Staff use the Microsoft Authenticator app on their work phone.
5. 3.5A sign in approval request that you did not start must be rejected and reported straight away.

Email, phishing and payments

1. 3.6Be cautious with links and attachments, especially ones that ask you to sign in, open an invoice you were not expecting or act urgently. If in doubt, do not click, and report it to the IT support provider.
2. 3.7Any request to change a customer's or supplier's bank details, or to make an urgent payment, must be checked by phoning the person on a number already held on file, never a number given in the email. This applies even when the email appears to come from a director.
3. 3.8Card numbers are never taken or sent by email, and are never written down. Card payments taken by phone are keyed directly into the card terminal.
4. 3.9Personal information is only emailed to the person it concerns or to someone with a business need for it. Check the recipient before sending.

Computers and work phones

1. 3.10Only company owned computers and work phones are used for company work. Personal phones and computers are not used to access company email or data unless the IT support provider has set them up and approved them.
2. 3.11Every computer has antivirus protection, receives security updates automatically, and has its storage encrypted so that data cannot be read if the device is lost or stolen. Updates must not be postponed for more than a few days.
3. 3.12Screens lock automatically after a short period. Lock your computer whenever you walk away from it.
4. 3.13Work phones are protected by a PIN or biometric lock and kept up to date. A lost or stolen phone or laptop must be reported the same day so that it can be locked or wiped remotely.
5. 3.14Only software approved and properly licensed by the company may be installed. USB memory sticks and external drives are not used for company data unless approved.

Network and Wi-Fi

1. 3.15The office network is protected by a firewall. Its settings are only changed by the IT support provider.
2. 3.16Visitors and personal devices use the separate guest Wi-Fi only. The staff Wi-Fi password is not given to visitors.

Handling customer information

1. 3.17Customer records are kept in the accounts system and company email, and not copied into personal files, spreadsheets on desktops or personal cloud storage.
2. 3.18Access to the accounts system is limited to the staff who need it for their job.
3. 3.19Signed delivery notes and other paperwork containing personal information are kept in the office, filed securely, and shredded when no longer needed. Paperwork is not left on desks or in vehicles.

Backups

1. 3.20The accounts data is backed up every day. Email and documents in Microsoft 365 are backed up separately, and backups are checked monthly by the IT support provider.
2. 3.21At least one backup copy is kept somewhere it cannot be changed or deleted from an ordinary office computer, so that it survives a ransomware attack. Restoring from backup is tested at least once a year.

Starters, leavers and training

1. 3.22The IT support provider is told about every new starter before their first day, and about every leaver no later than their last day. Leavers' accounts are disabled on their last day and company devices are returned.
2. 3.23All staff read this policy when they join and once a year after that, and take part in basic security awareness training.
3. 3.24Breaking this policy may lead to disciplinary action. Anyone unsure about anything in it should ask the data protection contact or the IT support provider.

Part 4

Data breach plan

A personal data breach is any event where personal information is lost, stolen, destroyed, changed or seen by someone who should not see it. Examples include an email sent to the wrong person, a hacked email account, a lost phone or laptop, a ransomware attack, or paperwork left where the public can read it.

1. 4.1Report. Tell Jay Curry (01977 66 22 77) and Leeds IT Services (0113 275 6610, info@leeds-it.co.uk) immediately, by phone if possible.
2. 4.2Contain. Leeds IT Services will take steps to limit the damage, such as resetting passwords, signing out sessions, locking or wiping a lost device, blocking a sender or isolating an infected computer.
3. 4.3Assess. The data protection contact, with help from Leeds IT Services, works out what information was involved, how many people are affected and how likely it is to cause them harm.
4. 4.4Notify the ICO. If the breach is likely to put people's rights at risk, the company reports it to the Information Commissioner's Office within 72 hours of becoming aware of it. The decision whether to report is the company's, made by a director.
5. 4.5Tell the people affected. If the risk to them is high, they are told without undue delay, in plain language, with advice on how to protect themselves.
6. 4.6Record and learn. Every breach is written in the breach log, whether or not it is reported, with what happened, what was done and what will change to stop it happening again.

Part 5

IT support and responsibilities

J&M Storage Systems uses Leeds IT Services Ltd as its IT support provider. This part sets out who is responsible for what, so that both businesses are clear and protected.

Roles under data protection law

1. 5.1J&M Storage Systems is the controller of its customer, staff and supplier data. Leeds IT Services is a processor. It may see or handle that data only to provide the IT services, and only on J&M's instructions.
2. 5.2Leeds IT Services is registered with the Information Commissioner's Office and handles its own clients' data under its own published terms and conditions.

What Leeds IT Services commits to

1. 5.3To use J&M's data only to provide the agreed services, and not for any other purpose.
2. 5.4To make sure its staff and subcontractors who may see the data are bound by confidentiality.
3. 5.5To use appropriate, industry standard security measures for the systems it manages, and to give J&M written security recommendations, including after each security audit.
4. 5.6To use other providers such as Microsoft and its email security vendor only where they give suitable data protection commitments, and to tell J&M if it plans to change them.
5. 5.7To tell J&M without undue delay if it becomes aware of a breach affecting J&M's data, and to help J&M contain it, investigate it and meet its reporting duties.
6. 5.8To help J&M respond to requests from individuals exercising their data rights, where those requests involve systems Leeds IT Services manages.
7. 5.9When the services end, to hand back J&M's data and admin access, and to delete any copies it holds, once the account has been settled.

What J&M Storage Systems is responsible for

1. 5.10Making sure staff follow the IT security policy in Part 3, and dealing with any breaches of it.
2. 5.11Telling Leeds IT Services promptly about starters, leavers, new devices, lost devices and changes to who should have access to what.
3. 5.12Its own legal duties as controller, including paying the ICO data protection fee, keeping this privacy notice accurate, responding to data rights requests, deciding whether to report a breach, and retention of its records.
4. 5.13Systems that Leeds IT Services does not manage, unless agreed in writing. These include the accounts software and its own backups, the card terminal and payment provider, the CCTV system, phone lines, and the company website, which is run by a separate provider.
5. 5.14Deciding whether to act on security recommendations, and providing the budget and access needed to put agreed measures in place.

Security recommendations and limits

1. 5.15No security measure can remove all risk. Leeds IT Services does everything reasonable to protect the systems it manages, but cannot guarantee that an attack, scam, data loss or outage will never happen.
2. 5.16Where Leeds IT Services recommends a security measure in writing (for example multi factor authentication, device encryption or a password manager) and J&M chooses not to adopt it, delays it, or asks for it to be switched off, J&M accepts the risk that results, and Leeds IT Services is not responsible for losses that the measure would reasonably have prevented. The decision is recorded.
3. 5.17Leeds IT Services is not responsible for losses caused by staff not following this policy, by payments made without the checks in clause 3.7, by third party systems it does not manage, or by data that falls outside the backup services it provides.
4. 5.18All IT services are provided under the Leeds IT Services terms and conditions, published at tnc.leeds-it.co.uk, including its limits of liability. If this document and those terms conflict on anything other than data protection duties, those terms apply.

Part 6

Document control