Data protection policy
Last reviewed 22 July 2026
Our internal standard for handling personal data, published so clients and their auditors can see how we work.
This is our current, working policy, written to match how we actually operate and the UK law that applies. Our ICO registration number and Companies House number will be added here and in the footer once confirmed. For a specific contractual form, ask us and we will provide a signed version.
The principles we work to
We hold ourselves to the UK GDPR principles on every engagement:
- Lawfulness, fairness and transparency: we are clear about what we do with data
- Purpose limitation and data minimisation: we collect only what the job needs
- Accuracy and storage limitation: we keep it correct and no longer than necessary
- Integrity and confidentiality: we secure it appropriately to the risk
- Accountability: we can show how we meet each of these
Controller and processor roles
For our own business data, such as enquiries and billing, we are the controller and our Privacy policy applies. When we build, host or run systems that hold your customers' data, you are the controller and we are your processor, bound by the Data Processing Agreement.
Security measures
Access is on a least privilege basis and protected by multi factor authentication. Data is encrypted in transit and, where appropriate, at rest. We keep systems patched, log administrative access, and where a client needs data to remain in the UK we build to keep it there. Staff and associates are bound by confidentiality and are briefed on data protection.
Breaches
If a personal data breach happens that is likely to be a risk to people, we will assess it without delay, notify the affected controller promptly so they can meet the ICO's seventy two hour reporting window, and support the investigation and remediation. Where we are the controller, we report to the ICO ourselves within that window.
Registration
As a data controller we are, or are in the process of being, registered with the Information Commissioner's Office. The registration number will be published here and in the site footer once confirmed.
Questions about this policy? Email [email protected] or see the rest of our legal and policy pages.