04

GDPR Policy

Aim and scope of policy 

This policy applies to the processing of personal data in manual and electronic records kept by the Company in connection with its human resources function as described below. It also covers the Company’s response to any data breach and other rights under the General Data Protection Regulation and current Data Protection Act. 

This policy applies to the personal data of job applicants, existing and former employees, apprentices, volunteers, placement students, workers and self-employed contractors. These are referred to in this policy as relevant individuals. 

“Personal data” is information that relates to an identifiable person who can be directly or indirectly identified from that information, for example, a person’s name, identification number, location, online identifier. It can also include pseudonymised data. 

“Special categories of personal data” is data which relates to an individual’s health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, and trade union membership. It also includes genetic and biometric data (where used for ID purposes). 

“Criminal offence data” is data which relates to an individual’s criminal convictions and offences. 

“Data processing” is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

The Company makes a commitment to ensuring that personal data, including special categories of personal data and criminal offence data (where appropriate) is processed in line with GDPR and domestic laws and all its employees conduct themselves in line with this, and other related, policies. 

Where third parties process data on behalf of the Company, the Company will ensure that the third party takes such measures in order to maintain the Company’s commitment to protecting data. In line with current data protection legislation, the Company understands that it will be accountable for the processing, management and regulation, and storage and retention of all personal data held in the form of manual records and on computers. 

Types of data held 

Personal data is kept in HR files or within the Company’s HR/Payroll and IT systems. The following types of data may be held by the Company, as appropriate, on relevant individuals: 

  • Name, address, phone numbers – for individual and next of kin 
  • CVs and other information gathered during recruitment 
  • References from former employers 
  • National Insurance numbers 
  • Job title, job descriptions and pay grades 
  • Conduct issues such as letters of concern, disciplinary proceedings 
  • Holiday records
  • Internal performance information 
  • Medical or health information 
  • Sickness absence records 
  • Tax codes 
  • Terms and conditions of employment 
  • Training details. 

Relevant individuals should refer to the Company’s Privacy Notice for more information on the reasons for its processing activities, the lawful bases it relies on for the processing and data retention periods. 

Data protection principles 

All personal data obtained and held by the Company will: 

  • Be processed fairly, lawfully and in a transparent manner 
  • Be collected for specific, explicit, and legitimate purposes 
  • Be adequate, relevant and limited to what is necessary for the purposes of processing 
  • Be kept accurate and up to date. Every reasonable effort will be made to ensure that inaccurate data is rectified or erased without delay 
  • Not be retained for longer than is necessary for its given purpose 
  • Be processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures 
  • Comply with the relevant data protection procedures for international transferring of personal data. 

In addition, personal data will be processed in recognition of an individuals’ data protection rights, as follows: 

  • The right to be informed 
  • The right of access 
  • The right for any inaccuracies to be corrected (rectification) 
  • The right to have information deleted (erasure) 
  • The right to restrict the processing of the data 
  • The right to portability 
  • The right to object to the inclusion of any information 
  • The right to regulate any automated decision-making and profiling of personal data. 

Procedures 

The Company has taken the following steps to protect the personal data of relevant individuals, which it holds or to which it has access: 

  • It appoints or employs individuals with specific responsibilities for: The processing and controlling of data 
  • The comprehensive reviewing and auditing of its data protection systems and procedures 
  • Overviewing the effectiveness and integrity of all the data that must be protected. 

There are clear lines of responsibility and accountability for these different roles. 

  1. It provides information to its employees on their data protection rights, how it uses their personal data, and how it protects it. The information includes the actions relevant individuals can take if they think that their data has been compromised in any way 
  2. It provides its employees with information and training to make them aware of the importance of protecting personal data, to teach them how to do this, and to understand how to treat information confidentially 
  3. It can account for all personal data it holds, where it comes from, who it is shared with and also who it might be shared with 
  4. It carries out risk assessments as part of its reviewing activities to identify any vulnerabilities in its personal data handling and processing, and to take measures to reduce the risks of mishandling and potential breaches of data security. The procedure includes an assessment of the impact of both use and potential misuse of personal data in and by the Company 
  5. It recognises the importance of seeking individuals’ consent for obtaining, recording, using, sharing, storing and retaining their personal data, and regularly reviews its procedures for doing so, including the audit trails that are needed and are followed for all consent decisions. The Company understands that consent must be freely given, specific, informed and unambiguous. The Company will seek consent on a specific and individual basis where appropriate. Full information will be given regarding the activities about which consent is sought. Relevant individuals have the absolute and unimpeded right to withdraw that consent at any time 
  6. It has the appropriate mechanisms for detecting, reporting and investigating suspected or actual personal data breaches, including security breaches. It is aware of its duty to report significant breaches that cause significant harm to the affected individuals to the Information Commissioner, and is aware of the possible consequences 
  7. It is aware of the implications of the international transfer of personal data. 

Access to data 

Relevant individuals have a right to be informed whether the Company processes personal data relating to them and to access the data that the Company holds about them. Data subjects have a right to make “subject access requests” at any time to find out more about the personal data the Company holds about them, what it is doing with that personal data, and why. 

Data subjects that wish to make a subject access request should contact the Company’s appointed Data Protection Officer, contact details below: 

Name: Chris Hall 

Email: chris.hall@extremegroup.co.uk 

Postal address: Extreme Exhibitions Ltd, Piquet House, Spring Lane, Ringwood, Hants, BH24 3FH, United Kingdom. 

The Company will not charge for the supply of data unless the request is manifestly unfounded, excessive or repetitive, or unless a request is made for duplicate copies to be provided to parties other than the employee making the request. 

The Company will respond to a request without delay. Access to data will be provided, subject to legally permitted exemptions, within one month as a maximum. This may be extended by a further two months where requests are complex or numerous. 

Relevant individuals must inform the Company immediately if they believe that the data is inaccurate, either as a result of a subject access request or otherwise. The Company will take immediate steps to rectify the information. Page 4 of 6 

Data disclosures 

The Company may be required to disclose certain data/information to any person. The circumstances leading to such disclosures include: 

  • Any employee benefits operated by third parties 
  • Disabled individuals – whether any reasonable adjustments are required to assist them at work 
  • individuals’ health data – to comply with health and safety or occupational health obligations towards the employee 
  • For Statutory Sick Pay purposes 
  • HR management and administration – to consider how an individual’s health affects his or her ability to do their job 
  • The smooth operation of any employee insurance policies or pension plans. 

These kinds of disclosures will only be made when strictly necessary for the purpose. 

Data protection impact assessments (DPIA) 

The Company shall carry out DPIA’s for any and all new projects and/or new uses of personal data which involve the use of new technologies and the processing involved is likely to result in a high risk to the rights and freedoms of data subjects under the GDPR. 

Data Protection Impact Assessments shall be overseen by the Data Protection Officer and shall address the following: 

  • The type(s) of personal data that will be collected, held, and processed 
  • The purpose(s) for which personal data is to be used 
  • The Company’s objectives 
  • How personal data is to be used 
  • The parties (internal and/or external) who are to be consulted 
  • The necessity and proportionality of the data processing with respect to the purpose(s) for which it is being processed 
  • Risks posed to data subjects 
  • Risks posed both within and to the Company 
  • Proposed measures to minimise and handle identified risks. 

Data security 

The Company adopts procedures designed to maintain the security of data when it is stored and transported. 

In addition, employees must: 

  • Ensure that all files or written information of a confidential nature are stored in a secure manner and are only accessed by people who have a need and a right to access them 
  • Ensure that all files or written information of a confidential nature are not left where they can be read by unauthorised people 
  • Refrain from sending emails containing sensitive work-related information to their personal email address 
  • Check regularly on the accuracy of data being entered into computers 
  • Always use the passwords provided to access the computer system and not abuse them by passing them on to people who should not have them 
  • Use computer screen blanking to ensure that personal data is not left on screen when not in use. 

Page 5 of 6 

  • Personal data relating to employees should not be kept or transported on laptops, USB sticks, or similar devices. Where personal data is recorded on any such device it should be protected by: 
  • Ensuring that data is recorded on such devices only where absolutely necessary 
  • Using an encrypted system — a folder should be created to store the files that need extra protection and all files created or moved to this folder should be automatically encrypted 
  • Ensuring that laptops or USB drives are not left lying around where they can be stolen. 

Failure to follow the Company’s rules on data security may be dealt with via the Company’s Disciplinary Procedure. Appropriate sanctions include dismissal with or without notice dependent on the severity of the failure. 

International data transfers 

Wherever possible The Company does not transfer personal data outside the European Economic Area (“EEA”). 

Some of our external third parties are based outside the EEA so their processing of your personal data may sometimes involve a transfer of data outside the EEA. 

In such circumstances consent is obtained and we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: 

  • We will only transfer personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries. 
  • Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the US. For further details, see European Commission: EU-US Privacy Shield. 

Breach notification 

Where a data breach is likely to result in a risk to the rights and freedoms of individuals, it will be reported to the Information Commissioner within 72 hours of the Company becoming aware of it and may be reported in more than one instalment. 

Individuals will be informed directly in the event that the breach is likely to result in a high risk to the rights and freedoms of that individual. 

If the breach is sufficient to warrant notification to the public, the Company will do so without undue delay. 

Training 

New employees must read and understand the policies on data protection as part of their induction. 

The nominated data protection officers for the Company are trained appropriately in their roles under data protection legislation. 

Records 

The Company keeps records of its processing activities including the purpose for the processing and retention periods in its HR data record. These records will be kept up to date so that they reflect current processing activities. Page 6 of 6 

All personal data collected for the purpose of this policy will be processed in line with data protection legislation. 

The Company reserves the right to modify any part of this policy at its discretion and in accordance with any required legislative changes. 

August 2026