The Company (sometimes referred to as “We”) takes the security and privacy of your data seriously. We need to gather and use information or ‘data’ about you as part of our business and to manage our relationship with you. We intend to comply with our legal obligations under the Data Protection Act 2018 (the ‘2018 Act’) and the EU General Data Protection Regulation (‘GDPR’) in respect of data privacy and security. We have a duty to notify you of the information contained in this policy.

This policy applies to clients or prospective clients. If you fall into one of these categories then you are a ‘data subject’ for the purposes of this policy.

The Company has measures in place to protect the security of your data in accordance with our Data Security Policy. A copy of this can be obtained from Susan Brown, the Data Protection Officer.

The Company will hold data in accordance with our Data Retention Policy. A copy of this can be obtained from Susan Brown. We will only hold data for as long as necessary for the purposes for which we collected it.

The Company is a ‘data controller’ for the purposes of your personal data. This means that we determine the purpose and means of processing your personal data.

This policy explains how the Company will hold and process your information. It explains your rights as a data subject and your obligations when obtaining, handling, processing or storing personal data in the course of working for, or on behalf of, the Company.

This policy is intended to be fully compliant with the 2018 Act and GDPR. If any conflict arises between those laws and this policy, the Company intends to comply with the 2018 Act and GDPR.

Personal data must be processed in accordance with six Data Protection Principles. It must:

We are accountable for these principles and must be able to demonstrate compliance.

Personal data means information which relates to a living person who can be identified from that data, either alone or when combined with other information likely to come into our possession.

This policy applies to all personal data whether stored electronically, on paper or on other materials.

Personal data may be provided by you, someone else such as your professional team, or created by us.

Personal data includes:

Some information is regarded as sensitive due to its nature and may require greater protection. It is not envisaged that we will hold such categories of personal data unless required by law.

Special categories of personal data include:

We may hold and use these categories of personal data where permitted by law.

Processing means any operation performed on personal data including:

The Company will process your personal data (including special categories where applicable) in accordance with our obligations under the 2018 Act.

We will use your personal data for:

We may process your personal data in the following situations:

We may share your personal data where necessary in accordance with contract or project requirements to carry out and perform our services for you.

We require all companies and practices that receive your information to keep your personal data confidential, secure and protected in accordance with the law.

We do not send your personal data outside the European Economic Area. If this changes, you will be notified of the protections in place.

Data subjects can make a Subject Access Request (SAR) to find out information we hold about them. This request must be made in writing.

If you would like to make a SAR regarding your personal data, please contact Susan Brown. We must respond within one month unless the request is complex or numerous.

There is no fee for making a SAR unless the request is manifestly unfounded or excessive.

You also have the right to complain to the Information Commissioner's Office (ICO). Further information can be found at www.ico.org.uk.

We will hold records about you securely and protect against unauthorised processing, accidental loss, destruction or damage using appropriate technical and organisational measures.

Examples of security measures include:

We will retain your personal data for as long as necessary for the purposes for which it is processed.

In most cases, it may be necessary to retain your data for up to 7 years to comply with contractual, statutory or insurance obligations such as dealing with claims.

When data is no longer required, it will be securely deleted or destroyed.