Section 1 - Policy
• If Acuity Care Group does not transfer personal data outside of the EEA, Acuity Care Group will delete the section entitled "Where we store your personal data"
• If Acuity Care Group is not required to appoint a Data Protection Officer, Acuity Care Group will delete references to the Data Protection Officer or will consider replacing references to the Data Protection Officer with references to the Privacy Officer at Acuity Care Group or other person nominated to have day-to-day responsibility for data protection and GDPR
1.4 Acuity Care Group must, therefore, update its processes for collecting consent for cookies. In practice, this means:
• Users must take a clear and positive action to consent to non-essential cookies
• The websites and apps of Acuity Care Group must tell users clearly what cookies will be set and what they do, including any third-party cookies
• Pre-ticked boxes or any equivalents, such as sliders defaulted to “on”, cannot be used for non- essential cookies
• The users at Acuity Care Group must have control over any non-essential cookies
• Non-essential cookies must not be set on landing pages before you gain the user’s consent Consent is not required for cookies that are defined as “strictly necessary” or that fall within the communication exemption. “Strictly necessary” cookies are those that are essential to providing the service requested by the user. Such cookies must be essential to fulfil their request. Those that are simply helpful or convenient, but not essential, or that are essential for the purposes of Acuity Care Group, will still require consent. The communication exemption is about the transmission of a communication over an electronic communications network. For the exemption to apply, the transmission of the communication must be impossible without the use of the cookie. Simply using a cookie to assist the communication is insufficient for the exemption to apply.
Acuity Care Group must note, in particular, that cookies used for analytical purposes or those used for marketing and advertising will always need consent as they are considered to be non-essential.
This guidance may change as the latest draft legislation is subject to some challenges on this point. Acuity Care Group must read the ICO’s cookie guidance available at: https://ico.org.uk/for- organisations/guide-to-pecr/cookies-and-similar-technologies/
for further information on the types of cookie that require consent.
Section 2 – Procedure
2.3 Acuity Care Group will use the template Fair Processing Notice to inform all other Data Subjects, including Clients, about how Acuity Care Group processes personal data other than personal data collected via the website.