Where, in accordance with the GDPR, the consent of the data subject is required for the processing of his or her personal data, it will be within the scope of this Policy.
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
As a data controller, Gulf Gas and Power UK is responsible under the GDPR for obtaining consent from the data subject under advisement from Data Protection Officer.
Gulf Gas and Power UK shall be able to demonstrate that the data subject has given explicit consent to the processing of his or her personal data.
Gulf Gas and Power UK shall also be able to demonstrate that the data subject has
- consented to the processing of his or her personal data for one or more specific purposes
- been informed of their right to withdraw consent before giving consent
- processing of data is limited to the contract bound by the explicit consent given by the data subject.
Gulf Gas and Power UK shall ensure that consent is,
- easily distinguishable from any other matter relating to the data subject
- in an intelligible and easily accessible form - using clear and plain language.
Gulf Gas and Power UK shall ensure that processing is limited to the contract bound by the explicit consent given by the data subject.
In order to further support the Consent Procedure, Gulf Gas and Power UK will ensure that;
- the request for consent is prominent and separate from our terms and conditions.
- data subjects positively opt in to the purpose of the consent
- pre-ticked boxes or any other type of default consent are prohibited
- we use clear, plain language that is easy to understand.
- we specify why we want the data and what we’re going to do with it.
- we give individual (‘granular’) options to consent separately to different purposes and types of processing.
- we name our business and any third-party controllers who will be relying on the consent.
- we tell individuals they can withdraw their consent.
- we ensure that individuals can refuse to consent without detriment.
- we avoid making consent a precondition of a service or contract
As a data controller, Gulf Gas and Power UK is committed under the GDPR to managing consent from the data subject, this includes;
- Reviewing consents to check that the relationship, the processing and the purposes have not changed.
- Refreshing consent at appropriate intervals, including any parental consents.
- We consider using privacy dashboards or other preference-management tools as a matter of good practice.
- Making it easy for individuals to withdraw their consent at any time and publicise how to do so.
- acting on withdrawals of consent as soon as we can.
Gulf Gas & Power UK Consent Policy May 2015 v1.0