GDPR Policy

1. Introduction

Dejas Consultancy Ltd is committed to ensuring the protection of personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This GDPR Policy outlines how we comply with legal requirements and uphold the rights of individuals whose personal data we process.

2. Scope

This policy applies to:

• All personal data processed by Dejas Consultancy Ltd
• Website enquiries and communications
• Prospective and existing customers
• Suppliers and third-party partners

3. Data Protection Principles

We adhere to the core GDPR principles:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimisation
• Accuracy of data
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

4. Lawful Basis for Processing

We process personal data in accordance with at least one lawful basis:

• Consent
• Legitimate interests
• Contractual necessity
• Legal obligations

5. Data Subject Rights

Individuals have the following rights under UK GDPR:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making

6. Data Security

We implement appropriate technical and organisational measures to protect personal data, aligned with ISO/IEC 27001 principles.

• Secure systems and infrastructure
• Encryption of data in transit
• Access control and authentication
• Regular risk assessment and monitoring
• Staff training and confidentiality agreements

7. Data Retention

Personal data is retained only as long as necessary for its intended purpose and in line with legal, regulatory, and contractual requirements.

8. Data Breaches

In the event of a personal data breach, we will:

• Assess and contain the incident promptly
• Notify the Information Commissioner's Office (ICO) where required
• Inform affected individuals when there is a high risk to their rights
• Document all breaches in accordance with compliance obligations

9. Third-Party Processing

Where third-party providers process personal data on our behalf, we ensure:

• Appropriate due diligence is performed
• Contracts include data protection obligations
• Security measures meet GDPR requirements

10. International Data Transfers

Where personal data is transferred outside the UK or EEA, appropriate safeguards such as Standard Contractual Clauses (SCCs) are implemented.

11. Responsibilities

Dejas Consultancy Ltd is responsible for ensuring compliance with this policy. All staff are required to follow data protection procedures and report concerns.

12. Policy Review

This GDPR Policy is reviewed regularly and updated to reflect changes in legislation or business practices.

13. Contact Information

For any GDPR-related queries, please contact:

Dejas Consultancy Ltd
Email: info@dejasconsultancy.co.uk
Address: 5 Marsden Close, Nottingham, NG6 0BR