Privacy Notice and Terms of Use

Introduction

The terms of use and privacy notice (“Notice”) describes the handling of data, including personal data, collected and used by the Department for Business and Trade (DBT). This includes communications to DBT, whether in electronic format, paper format or by telephone. By personal data, we mean any information relating to an identified or identifiable natural person.

The purpose of this Notice is to inform people what information is collected about them, by whichever means; how this information is used; if it is disclosed and ways in which we protect their privacy.

This Notice only relates to data that the “Check duties and customs procedures for exporting goods” service (“service”) collects and processes. We are not responsible for external organisations that may link to the service. For more information concerning external agencies and stakeholders please visit the relevant privacy statement on their own web pages.

Terms of use

While every effort has been made to make sure the Tariff information in this service is accurate, the user of the service is responsible for consulting the relevant legislation to make sure that the regulation is followed.

This service includes UK equivalents of EU legislation. It may not cover all the regulations that apply to a given commodity.

To find out other regulations that apply, visit the legislation.gov.uk website.

Privacy Notice

What data we collect from you

When you leave feedback on this service we collect your name and email address so that we can improve the service.

We also collect your name and email address when you use the contact form.

We use this data to:

• support businesses who submit queries to the department relating to EU Exit
• identify recurring queries relating to EU Exit which can be used to inform future service improvements
• better understand the trade and investment environment
• understand barriers to trade and investment
• design effective and intelligent trade and investment policy, services and make business decisions
• analyse service performance and user experience

Your personal information is being processed on the lawful basis of Public Task. The reason for processing your information is so that DBT or other government departments can respond to a user of this service with an answer to their query.

How long we keep your information

We will retain your personal information for seven years to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting, or reporting requirements.

Please be aware that, in accordance with the Freedom of Information Act 2000, public bodies are required to comply with a statutory code of practice which deals with (amongst other things) obligations of confidence. In view of this, if you wish for your information to be treated confidentially, it would be helpful if you could explain to us the reason. If we receive a Freedom of Information request for disclosure of that information, we will take full account of your explanation, but we cannot give an assurance that confidentiality can be maintained in all circumstances.

Cookies

All of the cookies set by this application are listed on the cookies page of the service.

What we do with your data

All data we collect is passed to the Department for Business and Trade’s enquiry management system, for processing and storage or to another relevant Government department, such as Defra.

Data submitted in the feedback form and contact form will be handled in line with the EU Exit Zendesk Fair Processing Notice.

Your legal rights in relation to personal data

Right to be informed about how personal data is used

You have the right to ask us whether we are collecting, using or sharing your personal data. You may ask us at any time whether we are collecting, using or sharing your personal data, what personal data of yours we have, why we have it and what we are going to do with it. Where we are collecting, using or sharing your personal data, you can ask us for a copy of it. We must usually respond to you within a month.

You may also ask us at any time to delete your personal data (sometimes called the ‘right to be forgotten’), or to correct it where you believe it may be wrong or incomplete, or to stop collecting, using or sharing your personal data, or to collect, use or share it in a more restricted way.

What we must tell you

Where you have made a request and we are collecting, storing, using or disclosing your personal data, we must tell you what personal data of yours we have; why we have it; what we are doing with it; whether we are sharing it with anyone, and if so, who we are sharing it with; whether we may share it with anyone in the future (including with anyone outside the European economic area and in which case what steps we are taking to keep your personal data safe); and how long we will be keeping your personal data for.

Where we are collecting, storing, using or disclosing your personal data, but have not collected it directly from you, but from a third party, we must tell you who that third party is, when we respond to your request.

Time for response and cost

We must answer your request and provide you with a copy of your personal data, free of charge, without undue delay and within a month of receiving your request.

But if your request is complex, or if you have made several requests, we may extend this time period by a further two months. Where we extend the time period, we must tell you we are going to do this, and why, within one month of receiving your request.

If you ask us for further copies of your personal data, or you make repeated requests, the law allows us to charge you a reasonable fee based on our administrative costs, or to refuse to deal with your requests.

Your right to have personal data erased in certain circumstances

Where we are collecting, using, storing or disclosing (processing) your personal data, you may ask us to delete it without undue delay where:

• we no longer need your personal data for the purposes for which we collected it or
• where you consented to us having your personal data and have now withdrawn that consent, unless the law allows us to keep your personal data without your consent or
• where you have objected to us collecting or handling your personal data or
• where we have collected or handled your personal data unlawfully or
• where the law says that we must delete your personal data

What if we have already published your personal data?

If we have agreed to your request to delete your personal data and we have already published it, we will take reasonable steps to notify others who are handling your personal data that you have requested deletion of it and of any copies of it, or links to it. Our ability to notify others may depend on the available technology and the cost to us.

Do we have to agree to your request?

We may not be able to delete your personal data for legal reasons. For example, where:

• the law requires or allows us to keep the personal data
• we need the personal data so that we can carry out our official work and it is in the public interest for us to keep it
• it is needed for archiving, historical research or statistical purposes
• it is needed for the establishment, exercise or defence of legal claims

Your right to rectification

Where we are collecting, using, storing or disclosing (processing) your personal data and you believe that the personal data we have is inaccurate, you may ask us to correct it. This is called your right to rectification.

Is your personal data incomplete?

You may also ask us to complete any personal data of yours that you believe is incomplete.

What we must do

Where you have made a request, we must correct your personal data without undue delay.

What if we have already shared your personal data?

Where we have already shared your personal data with anyone, we will notify them that you have asked us to correct it, unless notification is impossible or would involve a disproportionate effort by us. We must also tell you, if you ask us to, that we have notified the people that we have shared your personal data with.

Do we always have to agree to your request?

Sometimes the law allows us to restrict your right to rectification. For example, for reasons of:

• national security
• defence
• public security
• the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties
• protecting economic or financial interests, monetary, budgetary and taxation matters, public health and social security
• monitoring, inspection or regulatory functions
• protecting you or the rights of others
• the enforcement of civil claims

Right to restrict or object to processing of personal data in certain circumstances

You have a right to block the processing of your personal data in certain circumstances. This right arises if you are disputing the accuracy of personal data, if you have raised an objection to processing, if processing of personal data is unlawful and you oppose erasure and request restriction instead or if the personal data is no longer required by us but you require the personal data to be retained to establish, exercise or defend a legal claim;

Additionally, where we are collecting, using, storing or disclosing (processing) your personal data because we need it to carry out our official work (including if we are profiling your behaviour online or handling your personal data for archiving, historical research or statistical purposes) you may object at any time.

What we must do

If you object, we must stop collecting, using, storing or disclosing your personal data unless the law says that we can carry on.

For example, where:

• we can show that there are compelling and lawful reasons for us to carry on which we consider outweigh your right to object or
• we need the personal data to establish, exercise or defend a legal claim

Right to data portability

In certain circumstances you can request to receive a copy of your personal data in a commonly used electronic format. This right only applies to personal data that you have provided to us (for example by completing a form or providing information through a website). The right to data portability only applies if the processing is based on your consent or if the personal data must be processed for the performance of a contract and the processing is carried out by automated means (i.e. electronically);

Right not to be subject to automated decisions where the decision produces a legal effect or a similarly significant effect;

You have a right not to be subject to a decision which is based on automated processing where the decision will produce a legal effect or a similarly significant effect on you.

How to make a request for information under DPA

If you wish to ask us to restrict how we process your personal data or exercise any of your rights under data protection legislation, you should contact:

Data Protection Officer
Department for Business and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY
United Kingdom

Proof of identity

Before we can deal with your request to restrict processing, we may need to ask you for proof of identity. If so, we will ask you for a photocopy of the identity page of a current passport or current photo driving licence and an original, current utility bill (a gas, electricity, water, or telephone bill, or a credit card or bank statement) containing your name and address. We will return the utility bill to you if you ask us to.

Time for response and cost

We must answer your request free of charge, without undue delay and certainly within a month of receiving your request.

But if your request is complex, or if you have made several requests, we may extend this time period by a further two months. Where we extend the time period, we must tell you we are going to do this, and why, within one month of receiving your request.

If you make repeated requests, the law allows us to charge you a reasonable fee based on our administrative costs, or to refuse to deal with your requests.

Electronic requests

Where you make your request by email, unless you ask us not to, we will respond in an electronic form.

How to complain

If you are unhappy about how we are handling your request to restrict processing of your personal data, you may complain to:

Data Protection Officer
Department for Business and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY
United Kingdom

If you are not satisfied, you may escalate your complaint to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
casework@ico.org.uk
0303 123 1113

You also have the right to ask a Court to consider whether we have dealt properly with your request.

Changes to this notice

We may modify or amend this privacy notice at any time. Any modification or amendment to this privacy notice will be applied to your data immediately. We encourage you to review this privacy notice regularly to stay informed about how we’re protecting your data.