Purpose and scope
This policy explains the data protection principles Vanalum Limited applies when handling personal data in connection with website enquiries and ordinary business administration. It is intended to support responsible handling of information under the UK GDPR and Data Protection Act 2018.
Data protection principles
Personal data should be processed lawfully, fairly and transparently; collected for specified and legitimate purposes; limited to what is necessary; kept accurate where required; retained no longer than necessary; and protected using appropriate security measures. Accountability requires us to be able to explain the basis for processing and the controls used.
Lawful processing
Before processing personal data, an appropriate lawful basis should apply. Typical bases relevant to this website and our commercial activities include steps taken at an individual’s request before a contract, contract performance, legal obligation and legitimate interests. Consent is used only where it is appropriate and can be freely given and withdrawn.
Individual rights
Individuals may have rights of access, rectification, erasure, restriction, objection and portability, subject to legal conditions and exemptions. Requests should be sent to info@vanalum.co.uk. We may request proportionate identity verification where necessary to prevent unauthorised disclosure.
Subject access requests
Valid subject access requests should be recognised promptly, recorded and handled within the applicable statutory timeframe. Searches should be proportionate and cover relevant systems and records. Information concerning other people, legal privilege, confidentiality and applicable exemptions must be considered before disclosure.
Accuracy and minimisation
Only information reasonably needed for the relevant purpose should be collected. Where inaccurate information is identified and accuracy matters to the purpose of processing, reasonable steps should be taken to correct or update it.
Retention and disposal
Personal data should be retained according to the purpose of the record and any legal or commercial retention need. When information is no longer required, it should be securely deleted or disposed of where reasonably practicable.
Processors and third parties
Where another organisation processes personal data on our behalf, appropriate due diligence and contractual protections should be used. Access should be limited to what is required for the service being provided.
Security and access
Reasonable controls should be used to protect information against unauthorised access, accidental loss, alteration or disclosure. These may include access control, secure account practices, software maintenance, backups and proportionate staff procedures.
Personal data breaches
Suspected personal data breaches should be assessed promptly. Where notification to the Information Commissioner’s Office or affected individuals is legally required, the applicable statutory requirements should be followed. Material incidents should be documented along with decisions and remedial actions.
Automated decision-making
This website does not use automated decision-making to make significant decisions about customers by default. If that changes, the relevant processing should be reviewed and appropriate information and safeguards provided.
Responsibility and review
Data protection is an ongoing responsibility. This policy should be reviewed when systems, suppliers, processing activities or legal requirements materially change.