1. Purpose and scope
This policy describes the principles Printulk Limited follows when handling personal data in its business activities. It is intended to support compliance with the UK General Data Protection Regulation and the Data Protection Act 2018 where they apply.
2. Data protection principles
Personal data should be processed lawfully, fairly and transparently; collected for specified and legitimate purposes; limited to what is necessary; kept accurate where reasonably required; retained no longer than necessary; and protected with appropriate security. Printulk also aims to maintain records and evidence appropriate to its responsibilities.
3. Lawful processing
Before using personal data, Printulk should identify a lawful basis that fits the purpose. Common bases in a commercial context include contract, steps requested before a contract, legal obligation and legitimate interests. Consent should be used where appropriate and must be capable of being withdrawn when it is the basis relied on.
4. Data minimisation and accuracy
Only information reasonably needed for the relevant business purpose should be collected or retained. Staff and service providers handling information should take reasonable steps to correct material inaccuracies when identified.
5. Access and other individual rights
Individuals may have rights to access their personal data and request correction, erasure, restriction, portability or objection, subject to legal conditions. Requests should be directed to ferdow@printulk.com. Printulk may need to verify identity before disclosing personal data and may ask for clarification where necessary to locate the information requested.
6. Subject access requests
Valid access requests should be logged and handled within the timeframe required by law. Searches should be proportionate and relevant to the request. Information relating to other people, legal privilege, confidential references or other exemptions may require careful review before disclosure.
7. Retention and disposal
Personal data should be retained for a period justified by the purpose, legal obligations, contractual records, accounting requirements, possible disputes and operational needs. When information is no longer required, it should be deleted, anonymised or securely disposed of as appropriate.
8. Security
Access to personal data should be limited according to business need. Devices, accounts and services should use appropriate security controls, and confidential information should not be shared unnecessarily. Service providers processing personal data on Printulk’s behalf should be selected with due regard to security and data protection responsibilities.
9. Personal data breaches
A suspected loss, unauthorised disclosure, compromise or alteration of personal data should be assessed promptly. Printulk should document relevant facts, containment steps and risks. Where the law requires notification to the Information Commissioner’s Office or affected individuals, the applicable legal timetable should be followed.
10. Processors and third parties
Where another organisation processes personal data on Printulk’s documented instructions, suitable contractual and organisational arrangements should be used where required. Third parties acting as independent controllers are responsible for their own lawful processing.
11. International transfers
Where personal data is transferred internationally, Printulk should use a lawful transfer route and appropriate safeguards where UK law requires them.
12. Review
This policy should be reviewed when business processes, technologies, suppliers or legal requirements materially change.