Appropriate Policy Document Feb 26 Version 1.1 2

APPROPRIATE POLICY DOCUMENTFOR THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA AND CRIMINAL OFFENCE

DATA UNDER THE DATA PROTECTION LEGISLATION

What data protection legislation applies?

The processing of personal data by GroupNexus must be compliant with the UK Data ProtecHon Act 2018 (the “DPA”) as well as other related legislation which is applicable including the General Data Protection Regulation (EU) 2016/679 as implemented in the UK (the “UK GDPR”). Together, this legal framework is referred to in the rest of this document as the Data Protection Legislation.

What is the purpose of this document?

We process special category data in accordance with the requirements of ArHcle 9 of the UK GDPR and Schedule 1 of the DPA. Some of the Schedule 1 condiHons for processing special category and criminal offence data require us to have an Appropriate Policy Document (“APD”) in place, sedng out and explaining our procedures for securing compliance with the principles in ArHcle 5 of the UK GDPR and policies regarding the retenHon and erasure of such personal data.

This APD explains our processing and saHsfies the requirements of Schedule 1, Part 4 of the DPA and, along with our suite of data protecHon policies and noHces, aims to ensure that the processing of special categories of data carried out by [Company] is compliant with these requirements.

What is defined as special category data?

Special category data is defined at ArHcle 9 UK GDPR as personal data revealing:
• Racial or ethnic origin.
• PoliHcal opinions.
• Religious or philosophical beliefs.
• Trade union membership.
• GeneHc data.
• Biometric data for the purpose of uniquely idenHfying a natural person.
• Data concerning health; or
• Data concerning a natural person’s sex life or sexual orientaHon.

What is defined as special category data?

Criminal offence data is defined in SecHon 11 of the DPA as:

• Personal data relaHng to criminal convicHons and offences.
• The alleged commission of offences by the data subject; and
• Proceedings, disposal and sentencing for an offence commiled or alleged to have been commiled by the data subject.

What does processing mean under the UK GDPR?

Processing means almost any use of personal data that is part of or intended to be part of a filing system. This is a wide definiHon and includes almost anything you can do with personal data (e.g. storing it (whether you access it or not) and deleHng it are considered to be processing). Processing can be carried out on both electronic and paper records.