Please read this Privacy Notice. It relates to how QSR 2020 Ltd (”us” / “we” / “our”) hold and process your information (data) and your rights in relation to that data. QST and Quick Straight Teeth are the trading names of QST2020 Ltd. We are registered with the Information Commissioner’s Office. Our registration number is ZA028049. We are a limited company. Our company registration number is 12525529 and our registered office is at Market Street, Hebden Bridge, HX7 8AD. The person responsible for data protection at QST 2020 Ltd is Jessica Ryder (“Data Compliance Manager”) who can be contacted by email at [email protected] or in writing to our registered office address above. Our website is members.quickstraightteeth.net (“website”) We are a “data controller”. This means that we are responsible for deciding how we hold and use data about individuals in some circumstances. We are required under data protection legislation to notify you of the information contained in this privacy notice. We have a duty to keep data secure and maintain confidentiality and we will do so. We are also a “data processor” of data that is passed to us by dentists (Dentists) or which we process on behalf of Dentists in order to fulfil our contracts with those Dentists or dental practices.
(a) The data we process
The data we process depends upon our relationship with you, why we obtained the data, and for what purpose.
We obtain and hold data about and from our clients who are Dentists and dental practitioners. They refer their patients to us to undertake work upon their patients’ behalf. The Dentist data includes details of the business name, contact details (such as names, email addresses and direct and mobile telephone numbers), and addresses. We also obtain details of Dentists’ bank accounts and payment information and details of work we have carried out for Dentists and the cost of that work. We obtain this data for the purpose of carrying out work for the Dentists. This data is processed by us as it is necessary for us to do so to perform our contract with the Dentist or in anticipation that we will enter into a contract. We then continue to hold the data as we consider that is necessary for us to do so both in the legitimate interests of our business but also in the legitimate interests of the Dentists as the information we hold assists with future business relationships with our Dentist clients. The Dentist data we hold is shared with our associated companies. Please see the section below relating to Data Sharing.
Dentists send to us for processing personal data relating to their patients (Patients) when we are to carry out work for the Patient. The personal data we process about the Patients is limited to their names. The Patients’ data is processed by us as data processors. We have agreements in place between us and our Dentists relating to our processing of Patients’ data as data processors. The data of Patients is also passed to our contractors who undertake the work. Please see the section below relating to this (Data Sharing).
In the case of other companies, businesses, organisations or associations with whom we have a professional relationship or potentially common interest, we may also hold data comprising the contact details including names, company / business name, email address/es, contact telephone numbers, and postal address. The purpose we hold this data is for the professional relationship or in common interest with the other organisation. We consider that it is necessary for us to process this data on the lawful basis that it is in the legitimate interests of our business to enhance and preserve those relationships.
Visitors to our website
(b) Retention of data
Dentists [and individuals instructing us directly]
We may retain your data indefinitely, except that: (A) We will delete and destroy any bank or payment details once payment has been processed although some Dentists’ bank details are retained indefinitely to enable payment to be taken on a regular basis (subject to paragraph B below); (B) We regularly review the data that we hold, at least annually, and if we hold data about a Dentist with whom we have not had any dealings for over TWO years then we will destroy some of the data we no longer need, but will retain Dentists’ names and contact details, as we consider it is in the legitimate interests of our business to retain a database of these names and in doing so we do not believe that this will affect the rights and freedoms of the individuals concerned.
We will hold the data relating to Patients for seven years in line with British Dental Association guidelines. The data will then be deleted.
Visitors to our website
(c) Data Sharing
We instruct a third party who is based in the United Kingdom to undertake work carried out upon our Dentists, individual customers, and Patients’ behalf. We have a written agreement in place with this third party which regulates the purpose for which they hold and process the data. In addition, the data may be stored on a cloud based computer system. This is hosted and owned by Ecenica. We have a written agreement in place with this third party which regulates the purpose for which they hold and process the data and ensures that security measures are in place. We share the data we hold relating to Dentists with our associated companies. These are Academy of Clinical Excellence Limited (company registration number 06254493), Boutique Whitening Limited (company registration number 09132758), and BDS Laboratory LLP (LLP registration number OC367793). All of these companies are registered in England and Wales and with the Information Commissioner’s Office to process personal data. The information is shared as we consider that this may be of benefit to the Dentists, as all of these companies undertake work for Dentists in differing fields of dentistry. The data taken by cookies will also be shared with our website provider/host Ecenica. Our relationship with them is that they are a data processor upon our behalf and we have a written agreement in place with them which regulates this processing and which ensures that your data is kept secure. We may also share data with our legal advisers and accountants where we deem it necessary to do so. Your data will not otherwise be shared with any other third party without your consent. Save as we have set out above, data will not be held outside the EEA.
(d) Automated processing
We do not deal with the automated processing of data.
(e) Your Rights
(1) We are obliged to ensure that the data we hold about you is correct. You have the right to ask for the data to be rectified if it is not, and we will then take appropriate action to do so. (2) You have the right to seek to restrict the processing of your data in some circumstances. (3) Where we rely on legitimate interests as the basis for processing, you may ask for the data to be erased and if there is no overriding legitimate interest for us to continue the processing then we will do so. (4) You can also object to the processing of your data where we rely on legitimate interests as the basis for processing. (5) You have the right to seek confirmation of the fact that we are processing your data, to ask what that data comprises, and also to ask for copies of your data.
(f) How to exercise your rights
If you would like to exercise any of your rights, please write to us at the registered address given at the top of this Notice. We will then consider your request and action the same as necessary, although in some circumstances we may have a legitimate reason for not being able to action your request. If this should be the case then we will notify you of the reason why.
(g) If your have cause for complaint
If you have any cause for complaint, or do not believe that we are processing your data fairly or in line with our obligations as a data controller or a data processor, then we would ask that you contact us in the first instance with your concerns, although you are not obliged to do so and you may contact the Information Commissioner’s Office, whose details can be found at www.ico.org.uk
(i) Data controller
The data controller responsible in respect of the information collected on this website is QST 2020 Ltd. Our data protection registration number is ZA02804