Northwind Fund Services Limited

Process personal data lawfully, fairly and transparently in accordance with the data protection principles.

Process personal data only for specified, explicit and legitimate purposes.

Process personal data only to the extent necessary for the specified purpose.

Maintain accuracy of personal data and ensure inaccurate data is corrected or erased.

Retain personal data for no longer than necessary for the specified purpose.

Process personal data securely with appropriate technical and organisational measures.

Demonstrate compliance with the data protection principles through documented records.

Establish a lawful basis for every processing activity and document that basis before processing commences.

Identify a condition for the processing of special category personal data and document that condition before processing commences.

Provide data subjects with privacy information at the point of data collection in clear and accessible form.

Provide data subjects with privacy information within a reasonable period where data is not collected directly.

Notify the JOIC of personal data breaches without undue delay and, where feasible, within 72 hours of becoming aware.

Notify affected data subjects of personal data breaches likely to result in a high risk to their rights and freedoms.

Maintain a documented breach response plan covering identification, containment, notification and remediation.

Maintain a documented log of all personal data breaches whether or not reportable.

Appoint a Data Protection Officer where required and register with the Jersey Office of the Information Commissioner.

Maintain records of processing activities including purposes, categories of data, recipients, and retention periods.

Maintain records of processing activities including international transfers and the safeguards relied upon.

Conduct data protection impact assessments for processing likely to result in a high risk to the rights and freedoms of data subjects.

Consult the JOIC before commencing high-risk processing where the risks cannot be mitigated.

Respond to subject access requests within the statutory period of one month.

Respond to rectification, erasure, restriction, objection and portability requests within the statutory period.

Maintain a documented procedure for the identification, logging and response to data subject rights requests.

Maintain a documented procedure for the verification of the identity of data subjects exercising their rights.

Maintain documented procedures for the management of children's personal data, including age verification where relevant.

Maintain documented procedures for the management of automated decision-making and profiling impacting data subjects.

Maintain documented procedures for the management of data transfers to third countries.

Apply appropriate safeguards including standard contractual clauses where transferring personal data to third countries.

Maintain documented procedures for the management of joint controller and controller-processor relationships.

Maintain written agreements with all data processors covering the processing requirements set out in the law.