PRIVACY POLICY

Last updated: 12 October 2026

1. INTRODUCTION

1.1 West Industrial Company Limited, trading as West Industrial Company (“WIC”, “we”, “us” or “our”), explains in this Privacy Policy how we collect, use, disclose, retain and protect personal data.

1.2 This Policy applies to website visitors, prospective and existing clients, recipients of free resources, subscribers, business contacts, suppliers, subcontractors, reviewers and job applicants. Our Services are intended for businesses, but business records may contain personal data about identifiable individuals.

1.3 We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”), as amended, where applicable. Commercial emails sent to recipients in the United States are also subject to the CAN-SPAM Act and other applicable US requirements.

1.4 This Policy should be read alongside our Cookie Policy and any applicable data processing notice or agreement. Our Business Terms and Conditions govern the supply of Services. This Policy does not amend those Terms, constitute marketing consent or restrict statutory data protection rights.

2. CONTROLLER AND CONTACT DETAILS

2.1 The controller responsible for personal data processed for WIC’s own business purposes is:

2.2 Privacy matters are overseen by WIC’s management. We have not appointed a statutory Data Protection Officer. Individuals may contact us using the details above or through another available contact channel.

3. PERSONAL DATA WE PROCESS

3.1 Depending on the relationship and purpose, we may process:

  • Identity and contact data: name, organisation, job title, business email address, telephone number and correspondence address.

  • Business prospecting data: publicly available business contact details, professional role, relevant company information, source and collection date, checks on recipient status, outreach records and objections.

  • Commercial and transaction data: enquiries, bookings, quotations, orders, invoices, payment references, payment status, refunds and related correspondence.

  • Project and support data: requirements, approvals, meeting and training records, delivery and testing records, support requests, fault reports and relevant screenshots or files.

  • Client operational data: personal data made accessible where necessary for agreed work or technical support, which may include employee, customer or supplier information.

  • Technical and usage data: IP address, device and browser information, referring pages, link identifiers, click times, website activity, access and security logs, and cookie preferences, where collected through the relevant service and permitted by applicable law.

  • Marketing, attribution and preference data: enquiry source, content or campaign identifiers, resource requests, relevant link interactions, the association between an enquiry or customer record and its source, related purchase amounts and attributed revenue, subscription preferences, consent records, withdrawals and suppression records.

  • Feedback data: testimonials, reviews, reviewer names and related correspondence.

  • Recruitment data: CVs, qualifications, employment history and application correspondence.

3.2 We collect only information reasonably necessary for the relevant purpose. We do not retain complete payment-card details; those details are handled by the payment provider.

3.3 We do not routinely request special category data or criminal offence data. Such information should not be supplied unless necessary for an agreed lawful purpose. Where it is required, the applicable additional legal conditions and safeguards must be established before processing begins.

4. HOW WE OBTAIN PERSONAL DATA

4.1 We obtain personal data:

  • directly from individuals through forms, resource requests, subscriptions, purchases, bookings, email, telephone, meetings, applications and other correspondence, including enquiries arising from paid advertisements, social media content and newsletters;

  • from the organisation an individual represents, authorised colleagues, clients, suppliers or professional advisers;

  • from project materials and systems made available for an agreed engagement;

  • from providers involved in payments, communications, website services, link redirection and click measurement, advertising lead forms or the relevant engagement;

  • from public company websites, online business listings and directories, professional business profiles and business registers, for relevant business prospecting, verification or legal compliance where lawful; and

  • from public reviews, including reviews published on Trustpilot.

4.2 WIC researches publicly available business information to identify organisations for relevant introductory email outreach, subject to Section 9. Public availability is not consent to marketing or unrestricted permission to copy or collect information. We assess the source, accuracy, relevance, recipient status, reasonable expectations and lawful basis before using personal data. Any automated collection must also comply with applicable law and source restrictions. We do not use public-source information to circumvent an objection or withdrawal of consent.

4.3 Where we obtain personal data indirectly, we provide the required privacy information within a reasonable period and no later than one month, or earlier at the first communication or disclosure where required, unless a lawful exception applies. That information identifies the source, including whether it was publicly accessible. Where a specific source is known, we identify it rather than relying only on a general description of public sources. Providing this information does not itself permit an otherwise unlawful marketing email.

5. PURPOSES AND LAWFUL BASES

5.1 We process personal data for the following purposes and on the following lawful bases:

  • Enquiries, consultations and requested resources: legitimate interests in responding to requests and managing business relationships; contract or necessary steps before a contract where the individual is personally the contracting party.

  • Orders, project delivery, training and support: legitimate interests in administering and delivering business Services; contract where the individual is personally the contracting party and the processing is necessary.

  • Payments, refunds and financial administration: legitimate interests in administering transactions and preventing fraud; contract where applicable; legal obligations for required accounting and tax records.

  • Business prospecting and permitted introductory email: legitimate interests in identifying relevant business contacts and introducing WIC’s Services, only following a necessity and balancing assessment and where the proposed email is permitted by applicable electronic-marketing law. Where prior consent is required, we do not rely on legitimate interests to bypass it.

  • Email newsletters and ongoing subscription marketing: consent, following a voluntary opt-in, subject also to applicable PECR requirements.

  • Feedback, reviews and service improvement: legitimate interests in assessing service quality and managing feedback; consent where required for the communication or publication concerned.

  • Website operation, security and analytics: legitimate interests in administering, protecting and understanding use of the website; consent for cookies and similar technologies where required.

  • Content and revenue attribution: legitimate interests in measuring which content, campaigns and channels generate enquiries and purchases, and deciding where to direct future content production and expenditure, for proportionate analysis of voluntarily supplied source information and existing business records following a necessity and balancing assessment. Consent applies to tracking and subsequent use of information obtained through consent-dependent technologies. These purposes and their safeguards are explained in Section 15.

  • Complaints, disputes and legal claims: legitimate interests in resolving concerns and protecting legal rights; legal obligations where applicable.

  • Recruitment: necessary steps before an employment contract where applicable; legitimate interests in assessing candidates; legal obligations where applicable.

5.2 A contract with a company does not, by itself, provide a contractual lawful basis for processing its employees’ or representatives’ personal data. Our own administration of their business contact information will ordinarily rely on legitimate interests unless another basis applies.

5.3 Where we rely on legitimate interests, we assess necessity and proportionality and balance those interests against the individual’s rights and freedoms. Where processing relies on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

5.4 Personal data processed solely on a client’s behalf is subject to the arrangements in Section 7. The relevant controller is responsible for identifying the lawful basis for that underlying processing; its instructions are not themselves a separate UK GDPR lawful basis.

6. INFORMATION REQUIRED TO PROVIDE SERVICES

6.1 Information is generally supplied voluntarily. Contact, order, project and payment information may nevertheless be necessary to fulfil a request or perform an agreement. If necessary information is not provided, we may be unable to supply the requested resource or Service.

6.2 Certain information must be processed or retained to meet legal obligations, including accounting and tax requirements. Where a specific statutory or contractual obligation to provide personal data applies, we explain that requirement and the consequences of not providing the information.

6.3 Optional marketing consent is not a condition of obtaining a free resource, arranging a consultation or purchasing Services.

6.4 Providing a stated marketing source and agreeing to consent-dependent attribution tracking are optional. Declining either does not prevent access to the requested resource or Services. We may retain a source code lawfully supplied with a request, subject to Section 15, without treating it as marketing consent.

7. CLIENT DATA AND TECHNICAL SUPPORT

7.1 WIC acts as an independent controller for its own business administration. Where we process personal data on a client’s behalf and under its instructions, we act as a processor, or as a subprocessor where the client is itself a processor.

7.2 Development and demonstration ordinarily use simulated or demonstration data. Where agreed work or WIC Support requires access to live personal data, including data visible in systems, shared files or screenshots, access is limited to what is necessary for that work. Viewing personal data is processing even where no copy is retained.

7.3 Appropriate data processing terms are put in place before processing on a client’s behalf begins. These address instructions, confidentiality, security, subprocessors, international transfers, assistance with rights requests and incidents, and return or deletion of data.

7.4 Client personal data processed on instructions is not used for WIC’s unrelated purposes or marketing. The client remains responsible for its own lawful collection, use and disclosure of data. This does not remove WIC’s statutory obligations.

7.5 Supplying a template or free resource does not, by itself, give WIC access to data subsequently entered into the recipient’s own system. The recipient is responsible for its own processing. Contractual exclusions from WIC Support do not exclude applicable data protection duties.

8. DISCLOSURE OF PERSONAL DATA

8.1 We disclose personal data only where necessary and lawful. Recipients may include:

  • website hosting, website-form and website analytics providers;

  • branded-link, URL redirection and click-measurement providers;

  • business email, electronic communications and document collaboration providers;

  • cloud storage, customer relationship management and application-processing providers;

  • payment processors, banks and transaction administration providers;

  • subscription and email-marketing providers;

  • social media and advertising platforms through which individuals submit enquiries or lead forms;

  • review platforms, including Trustpilot where used for review invitations, management or display;

  • IT support, backup, cybersecurity and technology providers involved in the relevant processing;

  • authorised employees, consultants and subcontractors involved in delivering Services;

  • accountants, insurers, solicitors and other professional advisers;

  • courts, regulators, public authorities and law-enforcement bodies where disclosure is legally required or otherwise lawful; and

  • a prospective purchaser or successor where necessary for a business transaction, subject to appropriate safeguards.

8.2 Providers acting as processors are subject to appropriate contractual requirements. Independent controllers are responsible for their own processing and provide their own privacy information. Subprocessors used for client data are appointed in accordance with the applicable agreement and law.

8.3 We do not sell personal data or supply client contact lists to third parties for their unrelated marketing.

9. BUSINESS OUTREACH, INBOUND ENQUIRIES AND EMAIL MARKETING

9.1 WIC initially acquires prospective clients primarily through relevant introductory business emails to contacts identified from lawful public sources. The first email invites the recipient to make a voluntary, affirmative choice about receiving ongoing email marketing from WIC. This initial invitation is itself direct marketing and is sent only where lawful under the requirements below. Content production is also used as a longer-term means of attracting inbound enquiries; social media content, paid advertisements and opted-in newsletters may generate those enquiries.

9.2 We use information supplied in an enquiry to respond, provide requested resources or information and make relevant arrangements concerning the requested Services. Responses and follow-up remain relevant to the enquiry. An enquiry, resource request, advertisement click, social media interaction or purchase does not automatically enrol an individual in ongoing email marketing.

9.3 Newsletters and ongoing email marketing are sent only following a voluntary, specific and informed opt-in. Consent is requested separately from the enquiry or resource request, identifies WIC and the intended communications, and requires an affirmative choice. Optional consent boxes are not preselected. Silence, opening an email, following a link or accepting a privacy policy does not constitute marketing consent. Obtaining a free resource or purchasing Services is not conditional on subscribing.

9.4 We retain evidence of consent and review it at appropriate intervals. Where appropriate, existing subscribers are invited to reconfirm their preferences. We do not send consent-renewal messages to people who have withdrawn consent. Where renewed consent is required but not obtained, subscription marketing stops.

9.5 Individuals have an absolute right to object to processing for direct marketing, including related profiling. Marketing emails identify WIC and provide a valid, straightforward means of unsubscribing. Individuals may also contact WIC directly. Following an objection or withdrawal, we stop the relevant marketing use and retain only the minimum suppression information necessary to respect the preference. We do not seek renewed consent as a way to bypass an earlier objection.

9.6 Where an individual submits an enquiry through an advertising or social media platform, we use the information supplied to respond to that request. Those platforms also process information under their own privacy notices. Further privacy information and any required consent are provided before introducing advertising tracking, audience matching or other additional uses of personal data. Newsletter consent does not itself authorise those additional uses.

9.7 Necessary order, delivery, billing, security and support communications may continue following a marketing opt-out. A Project completion message may thank the client and provide relevant service information. Its sole call to action is an optional invitation to follow WIC’s Trustpilot link and publish a review of the client’s experience.

9.8 Review invitations are assessed according to their content and purpose. Where an invitation constitutes direct marketing, applicable marketing requirements and recorded preferences are respected. An invitation is not automatically exempt merely because it follows a completed Project.

9.9 Commercial emails to US recipients comply with applicable CAN-SPAM requirements, including accurate sender and subject information, identification of their commercial nature where required, a valid physical postal address and a clear opt-out. Opt-out facilities remain available for at least 30 days after sending. We honour objections promptly and, in any event, meet the applicable US maximum of 10 business days. Opting out does not require a payment or additional personal information beyond the email address. Sending communications overseas does not remove WIC’s applicable UK data protection or electronic-marketing obligations.

9.10 Where applicable US privacy law grants additional rights, individuals may exercise those rights using the contact details in Section 2. We assess requests under the law applicable to the circumstances.

9.11 Under applicable UK rules, prior PECR consent is not generally required for marketing emails to corporate subscribers, such as limited companies and limited liability partnerships. Where personal data is involved, WIC must nevertheless have a UK GDPR lawful basis and respect transparency and objection rights. We assess the recipient’s status and the relevance and proportionality of the proposed contact before sending an introductory email. The message identifies WIC, explains why the recipient has been approached, provides or links to the required privacy information, identifies the source of the contact details and gives a straightforward means of declining further contact.

9.12 Individual subscribers, including sole traders, certain partnerships and recipients using personally subscribed email accounts, receive additional protection under UK rules. Where prior consent is required, we do not send a cold email to ask for that consent. Such recipients are contacted for marketing only where valid prior consent or a fully applicable legal exception permits the communication. A publicly listed address, business purpose or US location does not by itself establish that the initial email is lawful. Where subscriber status or applicable requirements are uncertain, we apply the more protective approach.

9.13 A contact obtained for prospecting is not automatically added to newsletters or ongoing email-marketing campaigns. Without an affirmative opt-in, WIC does not send further unsolicited marketing following the initial invitation. A requested response, quotation or relevant discussion may be handled within the scope of that request. Failure to reply, opening the email, clicking a resource link or declining contact is not consent. Objections and withdrawals are honoured without seeking to obtain fresh consent through further unsolicited messages.

9.14 We assess the laws applicable to the recipient and proposed communication, including the US requirements in Section 9.9 where relevant. Targeting the United States does not remove WIC’s applicable UK obligations. Neither this Policy nor an invitation to opt in authorises collection or outreach that would otherwise be unlawful.

9.15 Our use of email providers must also comply with their applicable permission and acceptable-use requirements. Public-source contacts are not imported into an email campaign service which requires prior opt-in unless that permission has first been obtained and recorded. Where a provider does not permit cold outreach, it is not used to send an initial invitation requesting consent. Any permitted introductory outreach is handled separately from subscription campaigns.

10. REVIEWS, TESTIMONIALS AND PUBLICITY

10.1 Leaving an independent Trustpilot review is voluntary and does not affect agreed support entitlements. A representative or an automated email may send the invitation described in Section 9.

10.2 Sending a review link does not, by itself, require us to upload the recipient’s contact details to Trustpilot. If we use its invitation service, we provide only the information necessary for that service, such as name, email address and order reference. Project files and unnecessary personal data are not supplied for this purpose.

10.3 Trustpilot ordinarily acts as a processor for invitation information handled on our behalf and as an independent controller for its platform activities. Its privacy notice explains its own processing. Public reviews and replies may be visible to others. WIC avoids disclosing confidential information or unnecessary personal data in replies.

10.4 WIC may display permitted Trustpilot ratings and reviews on its website. Where an embedded display collects visitor information or uses cookies, the relevant privacy and consent requirements apply before consent-dependent technology operates.

10.5 Use of named testimonials, client names, logos, case studies and confidential material remains subject to the permissions required by our Business Terms and Conditions and applicable law. Commercial permission from a client does not replace the lawful basis or privacy information required for an identifiable individual’s personal data. Where consent is the basis, the individual may withdraw it.

11. INTERNATIONAL TRANSFERS

11.1 Some recipients may store personal data outside the United Kingdom or permit access from overseas. Where a restricted transfer occurs, we use a lawful transfer mechanism and any additional safeguards required.

11.2 This may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to appropriate standard contractual clauses. Where required, we assess the transfer risk and apply supplementary safeguards.

11.3 Individuals may contact legal@westindustrialcompany.com for information about the safeguards relevant to their data and how to obtain a copy, subject to necessary redaction of confidential information.

12. SECURITY AND CONFIDENTIALITY

12.1 We implement appropriate technical and organisational measures according to the nature and risks of processing. Access is restricted to authorised personnel and providers who require it for a lawful purpose.

12.2 Personnel permitted to access client personal data are subject to appropriate training, confidentiality obligations and data-handling procedures. They must not use, copy or disclose it for personal benefit or an unauthorised purpose. WIC oversees these obligations and investigates suspected misuse.

12.3 Client confidentiality applies alongside data protection law. Retention of project evidence does not authorise unrelated publication or reuse of identifiable information. Anonymised material may be used where identification is no longer reasonably possible; pseudonymised information remains personal data where an individual can still be identified.

12.4 No system can guarantee absolute security. This does not limit our obligation to apply appropriate safeguards or any liability which cannot lawfully be excluded.

13. RETENTION OF PERSONAL DATA

13.1 We retain personal data only for as long as necessary for its purpose, taking account of legal requirements, contractual obligations, the nature of the record and reasonably foreseeable disputes.

13.2 Our usual retention periods or criteria are:

  • Enquiries and unsuccessful proposals: up to 24 months after the last meaningful contact, unless earlier deletion or a justified continuation applies.

  • Public-source prospecting records: only while necessary to assess and make a permitted introductory approach or handle a resulting response. We review relevance and accuracy regularly and delete records when there is no continuing justified purpose, subject to minimum suppression and proportionate compliance records. Sending an invitation without a response does not itself justify indefinite retention or renew an enquiry retention period.

  • Client, project, order, contract and support records: generally up to seven years after completion, termination or final payment, whichever is later, where necessary for accounting, contractual or legal purposes.

  • Financial and tax records: generally seven years from the end of the relevant accounting period, subject to applicable requirements.

  • Marketing subscriptions and consent records: while the subscription remains active and for a proportionate period afterwards where necessary to demonstrate compliance.

  • Customer-linked content and revenue attribution: while necessary to measure the relevant business relationship and content performance, subject to periodic review; ordinarily no longer than 24 months after the last meaningful enquiry or purchase. Raw click and tracking records are retained for the shortest period necessary to establish and verify the source, taking account of consent and objections. Underlying financial and contract records may remain under their separate retention periods without retaining an unnecessary marketing link. Attribution is not retained permanently merely because it was recorded against a customer.

  • Suppression records: minimum information retained for as long as necessary to prevent unwanted marketing.

  • Feedback and review correspondence: while relevant to the review, service relationship or complaint; dispute-related records follow the applicable dispute retention period.

  • Unsuccessful recruitment applications: generally up to 12 months after the recruitment process ends. Longer retention for future opportunities requires an appropriate basis and notice.

  • Technical and security logs: for a period proportionate to security, investigation and website administration needs, reviewed against the relevant system settings.

  • Client data processed solely on instructions: as specified in the applicable processing agreement and instructions, including return or deletion at the end of the engagement unless law requires retention.

13.3 These periods do not require every record to be kept for the maximum duration. Longer retention may be justified by a legal claim, investigation or preservation obligation and will be assessed and documented.

13.4 Information no longer required is securely deleted, destroyed or irreversibly anonymised. Restricted backup copies may remain until the normal secure backup cycle expires. Independent controllers determine retention for information under their own control.

14. INDIVIDUAL RIGHTS

14.1 Subject to applicable conditions and exemptions, individuals may:

  • obtain access to their personal data;

  • request correction of inaccurate or incomplete data;

  • request erasure;

  • request restriction of processing;

  • object to processing based on legitimate interests;

  • receive qualifying data in a portable form; and

  • withdraw consent where processing relies on consent.

14.2 The right to object to direct marketing is absolute. Other rights depend on the circumstances and applicable law. Applicable rights relating to significant automated decisions remain available.

14.3 Requests may be sent to legal@westindustrialcompany.com or made through another contact channel. We may request proportionate information to verify identity or clarify a request where necessary. Requests are ordinarily free of charge, subject to lawful exceptions.

14.4 We respond without undue delay and normally within one month. Where an extension or adjustment to the response period is permitted by law, we provide the required explanation and notification. Any refusal is explained together with available complaint rights unless a lawful restriction prevents this.

14.5 Where WIC holds relevant data solely as a processor, we refer the request to the controller and assist as required. Contractual rules for formal notices do not restrict statutory privacy requests or postpone statutory response periods.

15. COOKIES, ANALYTICS AND CONTENT ATTRIBUTION

15.1 We use cookies and similar technologies for essential website functions and, subject to applicable requirements, website analytics. Technical and activity information is used to administer and protect the website and understand its use.

15.2 The cookie banner offers Accept all, Decline all and Manage cookies. Consent-dependent technologies are restricted until valid consent is obtained. Visitors may revisit their choices through Cookie Preferences.

15.3 Essential technologies may operate without consent where the relevant legal exception applies. Any other exception is used only where its conditions, including information and any required means of objection, are satisfied.

15.4 Our Cookie Policy provides further information about the technologies used, their purposes, providers and retention. Third-party features are assessed separately to ensure that required consent controls apply. Browser settings may also be used to manage cookies, although blocking essential technologies may affect website functions.

15.5 We measure which content, advertisements and channels lead to resource requests, enquiries and purchases. We may use a source stated on a form, a content-specific link or a campaign code to identify the relevant source. Where lawfully collected information permits, we associate that source with the relevant customer record and initial and subsequent purchases to calculate the revenue attributed to that content. This helps us assess commercial results and decide which content to continue producing.

15.6 Attribution uses the last identifiable relevant content link before the request where that information is available, or the source supplied by the individual. The recorded source is an attribution rule rather than proof that a particular item of content caused a purchase. Linking source information with an identifiable customer or purchase record remains personal data processing, even if only a code is used.

15.7 Links may contain content or campaign codes and, where necessary and lawful, a pseudonymous reference associated with a request or customer. Names, email addresses and other directly identifying contact details are not placed in publicly visible tracking URLs. A link provider may process click information, including the technical data described in Section 3, under the applicable processing arrangements. We limit that information to what is necessary and do not treat access to a link as permission for unrestricted tracking.

15.8 Where click measurement, link decoration, identifiers or other attribution technologies store information on, or access information from, a person’s device and require consent, we obtain valid consent before those operations occur, including at any redirect stage. Consent to receive newsletters is separate from consent to this tracking. Where required consent is declined or withdrawn, consent-dependent collection and use stop; requested resources remain available without that tracking. Source information voluntarily supplied on a form and proportionate analysis of existing business records are assessed separately under Section 5.

15.9 Attribution information is used for internal performance analysis and is subject to the retention periods in Section 13 and the rights in Section 14. Where attribution forms part of direct marketing or related profiling, an objection to that use is honoured absolutely. It does not determine an individual’s eligibility, price or access to Services. We use aggregated reports where practicable and may retain genuinely anonymous totals after deleting personal attribution records. A report is not anonymous where an individual remains reasonably identifiable.

16. AUTOMATION AND ARTIFICIAL INTELLIGENCE

16.1 We may use automated or AI-assisted processing where appropriate to a lawful purpose. Personal data is used only where necessary and subject to suitable contractual, confidentiality and security safeguards. Material AI-assisted output is subject to professional review.

16.2 Client personal data processed on instructions is not used to train general-purpose AI models for WIC’s own purposes. Any processing must remain within the applicable instructions and agreement.

16.3 We do not make solely automated decisions producing legal or similarly significant effects on individuals in our ordinary operations. If this changes, we provide the required information and safeguards before introducing the processing.

17. CHILDREN AND RECRUITMENT

17.1 Our website, resources and Services are intended for business use and are not directed towards children. Children’s personal data should not be supplied unless necessary for an agreed lawful purpose and subject to appropriate safeguards.

17.2 Recruitment information is used to assess suitability, communicate with applicants and comply with applicable obligations. Additional information is provided where particular checks require it. Applying for employment does not subscribe an applicant to sales marketing.

18. PERSONAL DATA BREACHES

18.1 We assess suspected personal data breaches and take appropriate steps to contain and address them.

18.2 Where WIC acts as controller, we notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to individuals’ rights and freedoms. Where a breach is likely to result in a high risk, affected individuals are notified without undue delay unless a lawful exception applies.

18.3 Where WIC acts as processor, we notify the relevant controller without undue delay after becoming aware of a personal data breach and provide the assistance required by the applicable agreement and law.

19. COMPLAINTS

19.1 Concerns about our handling of personal data may be raised using the contact details in Section 2. No particular form or legal terminology is required. Please provide enough information for us to investigate. We can assist with making a complaint where needed.

19.2 We acknowledge data protection complaints within 30 days of receipt, investigate without undue delay, keep the complainant appropriately informed and communicate the outcome and any action taken without undue delay.

19.3 Individuals also have the right to complain to the Information Commissioner’s Office:

- Website: https://ico.org.uk/make-a-complaint/.

- Telephone: 0303 123 1113.

20. CHANGES TO THIS POLICY

20.1 We review this Policy when our processing or legal requirements change. The current version is published on our website with its last-updated date. Further information is provided where a change materially affects individuals.

20.2 An update doesnot itself obtain consent, authorise an incompatible purpose or amend an existing Contract. External websites and platforms provide their own privacy information for processing under their independent control.