Privacy Policy
Review draft describing the processing of personal data.
This document is not an approved agreement or effective policy. It must not be adopted until missing information and legal decisions are verified. The date records only the draft revision.
01Controller and scope
The verified controller identity and contact details must be completed in Legal Information. Website visitors, customers and hosted data processed on a customer's behalf require separate assessment. Controller/processor roles and any necessary data processing agreement are not yet approved.
02Data collected
The current frontend stores language and currency preferences on the device. Ordering, payment and the client portal are not connected to this frontend. Future identity, billing, support, IP and security records must be verified against the actual system inventory; this draft does not claim all are collected today.
03Purposes and lawful bases
A processing-by-processing record must map data and lawful bases for service delivery, account administration, billing, security and saved preferences. Contract, legal obligation, legitimate interests or consent must not be assumed automatically; necessary assessments and consent processes await legal review.
05Retention and deletion
A retention period or criterion must be approved for each data category, including statutory retention, backup cycles, deletion and dispute exceptions. This draft sets no fixed retention period or immediate-deletion guarantee.
06International transfers
Storage countries and remote access locations must be verified. Required transfer mechanisms, assessments and safeguards under UK GDPR and any other applicable data protection regimes await specialist review. Having customers outside the UK alone does not describe all data flows.
07Rights and requests
Where applicable, information, access, rectification, erasure, restriction, objection, portability and withdrawal of consent must be addressed. Identity verification, request channels, response periods and complaints to the competent supervisory authority must be completed before publication; rights may depend on the basis and circumstances.
Verified legal entity details, operational records and legal review are required. Draft status must remain until every pending-verification item is completed with actual information.