Data Protection Policy

We process personal data in line with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

We only process personal data where we have a valid lawful basis, including contract performance, legitimate interests, legal obligation, or consent.

We collect only the personal data necessary for the purposes identified and take reasonable steps to keep it accurate and up to date.

We implement appropriate technical and organizational measures to protect personal data, including access controls, encryption in transit, secure infrastructure, vendor due diligence and staff confidentiality obligations.

Personal data is retained only for as long as necessary for the purposes for which it was collected and to meet legal, regulatory or contractual obligations.

We respect the rights of data subjects, including the right of access, rectification, erasure, restriction, objection, data portability and the right to withdraw consent.

Where we engage third-party processors, we conduct due diligence and enter into appropriate data processing agreements that require equivalent data protection standards.

Transfers of personal data outside the UK are made only where appropriate safeguards are in place, in accordance with UK GDPR requirements.

We maintain procedures for identifying, assessing and responding to personal data breaches, including notification to the Information Commissioner's Office and affected individuals where required.

This policy is reviewed regularly and updated to reflect changes in our processing activities and legal requirements.

For data protection queries, contact info@softbridgeltd.co.uk.