Privacy Policy
The GDPR and Marketing
Since the introduction of the General Data Protection Regulation (GDPR), direct mail has become an increasingly important way to communicate with both existing and prospective customers.
Under the GDPR, the use of personal data for direct marketing purposes can be considered a legitimate interest. While explicit consent is required for email marketing, SMS messages, and telephone sales calls, postal marketing does not require prior consent where legitimate interest applies.
All direct mail communications must clearly explain how recipients can opt out of future mailings.
Further guidance is available from the Information Commissioner’s Office (ICO):
https://ico.org.uk
GDPR Summary – Your Data in Safe Hands
The GDPR came into effect on 25 May 2018 and sets out strict requirements for how personal data is collected, stored, and used.
Further guidance is available from the Information Commissioner’s Office (ICO): https://ico.org.ukAt Think, we take data protection seriously. The summary below outlines the key principles we follow to ensure your information is handled responsibly and securely.
What is Personal Data?
The GDPR defines personal data as any information that relates to an identified or identifiable individual. This includes, but is not limited to:
- Names
- Identification numbers
- Location data
- Online identifiers
- Factors relating to physical, physiological, genetic, mental, economic, cultural, or social identity
Data Protection Principles
Anyone processing personal data must comply with the following principles. Personal data must be:
- Processed lawfully, fairly, and transparently
- Collected for clear, specific, and legitimate purposes
- Limited to what is necessary for those purposes
- Accurate and kept up to date, and corrected or deleted without undue delay when required
- Retained only for as long as necessary
- Protected using appropriate technical and organisational security measures
Accountability and Record Keeping
Organisations are required to maintain clear records of how personal data is handled. This includes:
- Security measures in place to protect data
- Details of the organisation, its Data Protection Officer, and any third-party data processors
- Identification and handling of sensitive data
- The source of the data
- The purpose for collecting and processing the data
- Data retention policies
Our Commitment at Think
- Data Protection Impact Assessments
- A clear Data Privacy Notice
- Data Processing Agreements
- A Data Retention Policy
- An Information Security Policy
- Ongoing GDPR training for staff
Copies of these documents are available upon request.
By following GDPR best practice, Think ensures your data is protected and handled with care at every stage.
This information is provided for general guidance only and does not constitute legal advice. For further details, please visit the Information Commissioner’s Office at https://ico.org.uk.