GDPR Compliance \u2014 BritHaven Tech<\/title>\n<link rel=\"preconnect\" href=\"https:\/\/fonts.googleapis.com\">\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Montserrat:wght@400;500;600;700;800&family=Poppins:wght@300;400;500;600;700&display=swap\" rel=\"stylesheet\">\n<style>\n*{box-sizing:border-box;margin:0;padding:0}\n:root{\n --ink:#0A0F1E;--navy:#0C1A4B;--navy2:#112266;--blue:#1547E8;--blue2:#0F39C8;\n --blue-lt:#EBF0FF;--sky:#E8F0FE;--white:#FFFFFF;\n --g50:#F7F8FC;--g100:#EDEEF4;--g200:#D8DAE8;--g400:#9BA3BF;--g600:#5C6480;--g700:#3A405A;\n --green:#0B7A45;--green-lt:#E6F5EE;--green-bd:#b7dfc9;\n --amber:#92400E;--amber-lt:#FFF8ED;--amber-bd:#F5D78B;\n --shadow-xs:0 1px 2px rgba(10,15,30,.06);--shadow-sm:0 2px 8px rgba(10,15,30,.08);\n --shadow-md:0 6px 20px rgba(10,15,30,.1);\n --r4:4px;--r6:6px;--r8:8px;--r10:10px;--r12:12px;--r16:16px;\n}\nbody{font-family:'Poppins',sans-serif;background:var(--white);color:var(--ink);line-height:1.6;font-size:14px}\n\n\/* \u2500\u2500 HERO \u2500\u2500 *\/\n.page-hero{background:var(--navy);padding:52px 24px;position:relative;overflow:hidden}\n.page-hero::before{content:'';position:absolute;inset:0;background:radial-gradient(ellipse 60% 120% at 85% 50%,rgba(21,71,232,.3) 0%,transparent 70%);pointer-events:none}\n.page-hero::after{content:'';position:absolute;bottom:-1px;left:0;right:0;height:40px;background:linear-gradient(to bottom,transparent,#fff);pointer-events:none;display:none}\n.ph-inner{max-width:1200px;margin:0 auto;position:relative;z-index:1}\n.ph-flag{display:inline-flex;align-items:center;gap:8px;padding:4px 14px;background:rgba(255,255,255,.08);border:1px solid rgba(255,255,255,.15);border-radius:20px;font-size:11px;font-weight:600;color:rgba(255,255,255,.8);letter-spacing:.04em;text-transform:uppercase;margin-bottom:16px}\n.ph-title{font-family:'Montserrat',sans-serif;font-size:32px;font-weight:800;color:#fff;line-height:1.15;letter-spacing:-.03em;margin-bottom:10px}\n.ph-sub{font-size:13.5px;color:rgba(255,255,255,.6);max-width:640px;line-height:1.8}\n.ph-meta{display:flex;gap:24px;margin-top:22px;flex-wrap:wrap}\n.ph-meta-item{font-size:11.5px;color:rgba(255,255,255,.5);display:flex;align-items:center;gap:6px}\n.ph-meta-item strong{color:rgba(255,255,255,.8);font-weight:600}\n\n\/* \u2500\u2500 COMPLIANCE STRIP \u2500\u2500 *\/\n.compliance-strip{background:var(--navy2);border-bottom:1px solid rgba(255,255,255,.06);padding:0 24px}\n.cs-inner{max-width:1200px;margin:0 auto;display:flex;gap:0;overflow-x:visible;flex-wrap:wrap;justify-content:center}\n.cs-item{display:flex;align-items:center;gap:9px;padding:13px 18px;font-size:12px;font-weight:600;color:rgba(255,255,255,.6);border-right:1px solid rgba(255,255,255,.06);white-space:normal;flex-shrink:0}\n.cs-item:first-child{padding-left:18px}\n.cs-dot{width:7px;height:7px;border-radius:50%;background:var(--green);flex-shrink:0;box-shadow:0 0 6px rgba(11,122,69,.6)}\n\n\/* \u2500\u2500 LAYOUT \u2500\u2500 *\/\n.layout{max-width:1200px;margin:0 auto;padding:24px 24px 44px;display:grid;grid-template-columns:248px 1fr;gap:44px;align-items:start}\n\n\/* \u2500\u2500 TOC \u2500\u2500 *\/\n.toc{position:sticky;top:84px}\n.toc-label{font-size:10px;font-weight:700;color:var(--g400);text-transform:uppercase;letter-spacing:.09em;margin-bottom:10px;padding:0 10px}\n.toc-title{font-size:10.5px;font-weight:700;color:var(--navy);text-transform:uppercase;letter-spacing:.09em;margin-bottom:14px;padding-bottom:8px;border-bottom:2px solid var(--blue)}\n.toc-item{display:block;padding:6px 10px;font-size:12px;color:var(--g600);cursor:pointer;border-radius:var(--r6);transition:all .15s;text-decoration:none;border-left:2px solid transparent;margin-bottom:2px;line-height:1.4}\n.toc-item:hover{background:var(--g50);color:var(--blue)}\n.toc-item.active{background:var(--blue-lt);color:var(--blue);border-left-color:var(--blue);font-weight:600}\n.toc-num{font-size:10px;color:var(--g400);margin-right:4px;font-weight:700}\n.toc-divider{height:1px;background:var(--g100);margin:12px 0}\n\n\/* \u2500\u2500 DOCUMENT \u2500\u2500 *\/\n.doc{min-width:0}\n\n.doc-intro{background:var(--g50);border:1.5px solid var(--g200);border-radius:var(--r12);padding:20px 22px;margin-bottom:36px}\n.di-title{font-family:'Montserrat',sans-serif;font-size:14px;font-weight:700;color:var(--navy);margin-bottom:6px}\n.di-body{font-size:13px;color:var(--g700);line-height:1.8}\n\n.section{margin-bottom:44px;scroll-margin-top:100px}\n.section-header{display:flex;align-items:center;gap:12px;margin-bottom:20px;padding-bottom:12px;border-bottom:2px solid var(--g100)}\n.section-num{font-family:'Montserrat',sans-serif;font-size:11px;font-weight:800;color:var(--blue);background:var(--blue-lt);padding:3px 9px;border-radius:4px;letter-spacing:.04em;flex-shrink:0}\n.section-title{font-family:'Montserrat',sans-serif;font-size:17px;font-weight:700;color:var(--navy);letter-spacing:-.02em}\n\n.doc p{font-size:13.5px;color:var(--g700);line-height:1.8;margin-bottom:14px}\n.doc p:last-child{margin-bottom:0}\n\n.clause{margin-bottom:22px}\n.clause-label{font-size:12px;font-weight:700;color:var(--navy);text-transform:uppercase;letter-spacing:.06em;margin-bottom:8px;display:flex;align-items:center;gap:7px}\n.clause p{font-size:13px;color:var(--g700);line-height:1.8;margin-bottom:0}\n\n.doc ul,.doc ol{padding-left:20px;margin:10px 0 14px}\n.doc ul li,.doc ol li{font-size:13px;color:var(--g700);line-height:1.8;margin-bottom:7px;padding-left:4px}\n.doc ul li strong,.doc ol li strong{color:var(--navy)}\n\n\/* \u2500\u2500 INFO BOXES \u2500\u2500 *\/\n.box{border-radius:var(--r10);padding:16px 20px;margin:16px 0}\n.box.blue{background:var(--blue-lt);border:1px solid rgba(21,71,232,.18)}\n.box.blue .bx-t{color:var(--blue2)}.box.blue .bx-b{color:var(--blue2)}\n.box.green{background:var(--green-lt);border:1px solid var(--green-bd)}\n.box.green .bx-t{color:var(--green)}.box.green .bx-b{color:#155c35}\n.box.amber{background:var(--amber-lt);border:1px solid var(--amber-bd)}\n.box.amber .bx-t{color:var(--amber)}.box.amber .bx-b{color:var(--amber)}\n.box.grey{background:var(--g50);border:1.5px solid var(--g200)}\n.box.grey .bx-t{color:var(--navy)}.box.grey .bx-b{color:var(--g700)}\n.bx-t{font-size:11.5px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;margin-bottom:7px}\n.bx-b{font-size:13px;line-height:1.75}\n\n\/* \u2500\u2500 PRINCIPLES GRID \u2500\u2500 *\/\n.principles-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px;margin:18px 0}\n.principle-card{background:#fff;border:1.5px solid var(--g100);border-radius:var(--r10);padding:16px;transition:border-color .2s,box-shadow .2s}\n.principle-card:hover{border-color:var(--blue);box-shadow:var(--shadow-sm)}\n.pc-icon{font-size:22px;margin-bottom:9px}\n.pc-title{font-size:12.5px;font-weight:700;color:var(--navy);margin-bottom:5px}\n.pc-body{font-size:12px;color:var(--g600);line-height:1.65}\n\n\/* \u2500\u2500 LAWFUL BASIS TABLE \u2500\u2500 *\/\n.basis-table{width:100%;border-collapse:collapse;margin:16px 0;font-size:12.5px}\n.basis-table th{background:var(--navy);color:#fff;padding:10px 14px;text-align:left;font-weight:600;font-size:11px;text-transform:uppercase;letter-spacing:.05em}\n.basis-table th:first-child{border-radius:var(--r6) 0 0 0}\n.basis-table th:last-child{border-radius:0 var(--r6) 0 0}\n.basis-table td{padding:10px 14px;border-bottom:1px solid var(--g100);color:var(--g700);line-height:1.6;vertical-align:top}\n.basis-table tr:last-child td{border-bottom:none}\n.basis-table tr:nth-child(even) td{background:var(--g50)}\n.basis-table td:first-child{font-weight:700;color:var(--navy);white-space:nowrap}\n.art-ref{display:inline-block;padding:1px 7px;background:var(--blue-lt);color:var(--blue2);border-radius:3px;font-size:10.5px;font-weight:700;white-space:nowrap}\n\n\/* \u2500\u2500 RIGHTS GRID \u2500\u2500 *\/\n.rights-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px;margin:18px 0}\n.right-card{background:#fff;border:1.5px solid var(--g100);border-radius:var(--r10);padding:16px;transition:border-color .2s,box-shadow .2s}\n.right-card:hover{border-color:var(--blue);box-shadow:var(--shadow-sm)}\n.rc-icon{font-size:20px;margin-bottom:8px}\n.rc-title{font-size:12.5px;font-weight:700;color:var(--navy);margin-bottom:5px}\n.rc-body{font-size:12px;color:var(--g600);line-height:1.65}\n\n\/* \u2500\u2500 SECURITY GRID \u2500\u2500 *\/\n.security-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:12px;margin:18px 0}\n.sec-card{background:var(--navy);border-radius:var(--r10);padding:18px;color:#fff}\n.sc-icon{font-size:22px;margin-bottom:10px}\n.sc-title{font-size:12.5px;font-weight:700;color:#fff;margin-bottom:6px}\n.sc-body{font-size:12px;color:rgba(255,255,255,.6);line-height:1.65}\n\n\/* \u2500\u2500 CONTACT CARDS \u2500\u2500 *\/\n.contact-row{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-top:20px}\n.contact-card{border-radius:var(--r12);padding:20px}\n.contact-card.navy{background:var(--navy)}\n.contact-card.grey{background:var(--g50);border:1.5px solid var(--g200)}\n.cc-title{font-family:'Montserrat',sans-serif;font-size:14px;font-weight:700;margin-bottom:4px}\n.contact-card.navy .cc-title{color:#fff}\n.contact-card.grey .cc-title{color:var(--navy)}\n.cc-sub{font-size:12px;margin-bottom:14px;line-height:1.6}\n.contact-card.navy .cc-sub{color:rgba(255,255,255,.5)}\n.contact-card.grey .cc-sub{color:var(--g600)}\n.cc-items{display:flex;flex-direction:column;gap:8px}\n.cc-item{font-size:12.5px;display:flex;align-items:flex-start;gap:8px;line-height:1.5}\n.contact-card.navy .cc-item{color:rgba(255,255,255,.7)}\n.contact-card.navy .cc-item strong{color:#fff}\n.contact-card.grey .cc-item{color:var(--g700)}\n.contact-card.grey .cc-item strong{color:var(--navy)}\n.cc-icon{width:26px;height:26px;border-radius:var(--r6);display:flex;align-items:center;justify-content:center;font-size:12px;flex-shrink:0;margin-top:1px}\n.contact-card.navy .cc-icon{background:rgba(255,255,255,.08)}\n.contact-card.grey .cc-icon{background:var(--g100)}\n\n@media(max-width:900px){\n .layout{grid-template-columns:1fr}\n .toc{display:none}\n .contact-row{grid-template-columns:1fr}\n .principles-grid,.rights-grid,.security-grid{grid-template-columns:1fr 1fr}\n}\n@media(max-width:580px){\n .principles-grid,.rights-grid,.security-grid{grid-template-columns:1fr}\n .cs-inner{gap:0;flex-direction:column;align-items:flex-start}\n .cs-item{width:100%;border-right:none;border-bottom:1px solid rgba(255,255,255,.06);padding:12px 0}\n .cs-item:first-child{padding-left:0}\n}\n\n\/* ===================================================\n BRITHAVEN FONT OVERRIDE\n Headings = Montserrat\n Paragraph\/content = Poppins\n =================================================== *\/\nh1,h2,h3,h4,h5,h6,\n.logo-mark,\n.logo-text,\n.ph-title,\n.di-title,\n.section-num,\n.section-title,\n.cc-title,\n.pc-title,\n.rc-title,\n.sc-title,\n.clause-label,\n.bx-t,\n.toc-title,\n.tb-badge,\n.art-ref{\n font-family:'Montserrat',sans-serif !important;\n}\n\nbody,\np,\nspan,\ndiv,\nli,\ntd,\nth,\ninput,\ntextarea,\nbutton,\n.ph-sub,\n.di-body,\n.pc-body,\n.rc-body,\n.sc-body,\n.bx-b,\n.cc-sub,\n.cc-item,\n.toc-item,\n.doc p,\n.doc li{\n font-family:'Poppins',sans-serif !important;\n}\n\n<\/style>\n<\/head>\n<body>\n\n\n<section class=\"page-hero\">\n <div class=\"ph-inner\">\n <div class=\"ph-flag\"> Legal & Compliance<\/div>\n <h1 class=\"ph-title\">GDPR Compliance<\/h1>\n <p class=\"ph-sub\">BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018.<\/p>\n <div class=\"ph-meta\">\n <div class=\"ph-meta-item\">\ud83d\udcc5 <strong>Last Updated:<\/strong> 27 May 2025<\/div>\n <div class=\"ph-meta-item\">\ud83c\udfdb\ufe0f <strong>Governing Law:<\/strong> England & Wales<\/div>\n <div class=\"ph-meta-item\">\ud83d\udee1\ufe0f <strong>Framework:<\/strong> UK GDPR \u00b7 DPA 2018 \u00b7 PECR<\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n<div class=\"compliance-strip\">\n <div class=\"cs-inner\">\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> UK GDPR Compliant<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> Data Protection Act 2018<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> ICO Registered<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> Privacy by Design<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> DPA Agreements in Place<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> PECR Compliant<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> Annual Review<\/div>\n <\/div>\n<\/div>\n\n\n<div class=\"layout\">\n\n \n <nav class=\"toc\">\n <div class=\"toc-title\">Contents<\/div>\n <a class=\"toc-item active\" href=\"#s1\"><span class=\"toc-num\">01<\/span> Our Commitment<\/a>\n <a class=\"toc-item\" href=\"#s2\"><span class=\"toc-num\">02<\/span> Legal Framework<\/a>\n <a class=\"toc-item\" href=\"#s3\"><span class=\"toc-num\">03<\/span> Data Controller Role<\/a>\n <a class=\"toc-item\" href=\"#s4\"><span class=\"toc-num\">04<\/span> Lawful Bases<\/a>\n <a class=\"toc-item\" href=\"#s5\"><span class=\"toc-num\">05<\/span> Data Principles<\/a>\n <a class=\"toc-item\" href=\"#s6\"><span class=\"toc-num\">06<\/span> Data Subject Rights<\/a>\n <a class=\"toc-item\" href=\"#s7\"><span class=\"toc-num\">07<\/span> Data Retention<\/a>\n <a class=\"toc-item\" href=\"#s8\"><span class=\"toc-num\">08<\/span> Data Security<\/a>\n <a class=\"toc-item\" href=\"#s9\"><span class=\"toc-num\">09<\/span> Third-Party Processors<\/a>\n <a class=\"toc-item\" href=\"#s10\"><span class=\"toc-num\">10<\/span> International Transfers<\/a>\n <a class=\"toc-item\" href=\"#s11\"><span class=\"toc-num\">11<\/span> Records of Processing<\/a>\n <a class=\"toc-item\" href=\"#s12\"><span class=\"toc-num\">12<\/span> Privacy by Design<\/a>\n <a class=\"toc-item\" href=\"#s13\"><span class=\"toc-num\">13<\/span> Cookies & Marketing<\/a>\n <a class=\"toc-item\" href=\"#s14\"><span class=\"toc-num\">14<\/span> DPIAs<\/a>\n <a class=\"toc-item\" href=\"#s15\"><span class=\"toc-num\">15<\/span> Complaints & Contact<\/a>\n <a class=\"toc-item\" href=\"#s16\"><span class=\"toc-num\">16<\/span> Review & Governance<\/a>\n <\/nav>\n\n \n <article class=\"doc\">\n\n <div class=\"doc-intro\">\n <div class=\"di-title\">About This Page<\/div>\n <div class=\"di-body\">TThis page sets out BritHaven Tech Limited's approach to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It is intended to provide transparency about our data protection practices and to help our clients, partners, and website visitors understand how we uphold their rights.\n<\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s1\">\n <div class=\"section-header\">\n <span class=\"section-num\">01<\/span>\n <h2 class=\"section-title\">Our Commitment to Data Protection<\/h2>\n <\/div>\n <p>BritHaven Tech Limited is committed to processing personal data responsibly, lawfully, and transparently. As an authorised UK technology reseller, we handle personal data in the course of our day-to-day commercial activities, including managing client accounts, processing orders, and operating our website.<\/p>\n<p>We recognise that data protection is not merely a legal obligation but a fundamental aspect of the trust our clients and partners place in us. We are committed to embedding a culture of privacy across our organisation and to continually reviewing and improving our data protection practices.\nWe do not sell personal data. We process only what is necessary. We are transparent about how and why we process data. We uphold the rights of every individual whose data we handle.\n<\/p>\n <div class=\"box green\">\n <div class=\"bx-t\">\u2705 Our Core Pledge<\/div>\n <div class=\"bx-b\">We do not sell personal data. We process only what is necessary. We are transparent about how and why we process data. We uphold the rights of every individual whose data we handle.<\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s2\">\n <div class=\"section-header\">\n <span class=\"section-num\">02<\/span>\n <h2 class=\"section-title\">Our Legal Framework<\/h2>\n <\/div>\n <p>BritHaven Tech Limited processes personal data in accordance with the following legislation and regulatory guidance:\n<\/p>\n <ul>\n <li><strong>the primary legislative framework governing the processing of personal data in the United Kingdom following the UK's exit from the European Union.\n<\/li>\n <li><strong>Data Protection Act 2018 (DPA 2018)<\/strong> \u2014 the UK statute that supplements and gives effect to the UK GDPR and governs certain processing activities not covered by it.\n<\/li>\n <li><strong>Privacy and Electronic Communications Regulations 2003 (PECR)<\/strong> \u2014 which govern electronic marketing, the use of cookies, and related communications.\n<\/li>\n <li><strong>Network and Information Systems (NIS) Regulations 2018<\/strong> \u2014 relevant to our obligations as a technology service provider in respect of cybersecurity and incident reporting.\n<\/li>\n <\/ul>\n <p>We monitor regulatory guidance issued by the Information Commissioner's Office (ICO) and update our practices accordingly.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s3\">\n <div class=\"section-header\">\n <span class=\"section-num\">03<\/span>\n <h2 class=\"section-title\">Our Role as Data Controller<\/h2>\n <\/div>\n <p>BritHaven Tech Limited acts as the data controller in respect of personal data collected through our website, quote request process, and direct commercial relationships. As data controller, we determine the purposes and means of processing and bear \n<\/p>\n <p>primary responsibility for ensuring that processing is lawful.\nIn certain circumstances \u2014 for example, where we process personal data on behalf of a client organisation \u2014 we may act as a data processor. In such cases, processing is governed by a written Data Processing Agreement (DPA) in accordance with Article 28 of the UK GDPR.<\/p>\n <div class=\"contact-row\">\n <div class=\"contact-card navy\">\n <div class=\"cc-title\">Data Protection Officer \/ Privacy Contact:\n<\/div>\n <div class=\"cc-sub\">Contact our DPO for all data protection matters.<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udce7<\/div><div><strong>dpo@brithaven.co.uk<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udfe2<\/div><div><strong>Data Protection Officer, BritHaven Tech Limited, [Company Address], England<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <div class=\"contact-card grey\">\n <div class=\"cc-title\">ICO Registration<\/div>\n <div class=\"cc-sub\">BritHaven Tech is registered with the ICO as a data controller.<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udd22<\/div><div>ICO Registration Number:<strong>[Z0000000]<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udf10<\/div><div><strong>ico.org.uk<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s4\">\n <div class=\"section-header\">\n <span class=\"section-num\">04<\/span>\n <h2 class=\"section-title\">Lawful Bases for Processing<\/h2>\n <\/div>\n <p>We process personal data only where we have identified a valid lawful basis under Article 6 of the UK GDPR. The lawful bases we rely upon are as follows:<\/p>\n\n <table class=\"basis-table\">\n <thead>\n <tr>\n <th>Lawful Basis<\/th>\n <th>Article Ref.<\/th>\n <th>How We Use It<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td>Performance of a Contract<\/td>\n <td><span class=\"art-ref\">Article 6(1)(b)<\/span><\/td>\n <td>We process personal data where it is necessary to perform a contract to which the data subject is party, or to take steps at their request prior to entering into a contract. This applies to the processing of client contact details, order information, invoice management, and account administration.\n<\/td>\n <\/tr>\n <tr>\n <td>Legitimate Interests<\/td>\n <td><span class=\"art-ref\">Article 6(1)(f)<\/span><\/td>\n <td>We process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by the rights and freedoms of the data subject. We conduct Legitimate Interests Assessments (LIAs) in respect of all processing activities where this basis is relied upon, including direct marketing to existing business contacts and website analytics.\n<\/td>\n <\/tr>\n <tr>\n <td>Legal Obligation<\/td>\n <td><span class=\"art-ref\">Article 6(1)(c)<\/span><\/td>\n <td>We process personal data where necessary to comply with a legal obligation to which we are subject, including tax reporting, VAT record-keeping, anti-money laundering checks, and compliance with court orders or regulatory requirements.\n<\/td>\n <\/tr>\n <tr>\n <td>Consent<\/td>\n <td><span class=\"art-ref\">Article 6(1)(a)<\/span><\/td>\n <td>Where we rely on consent \u2014 for example, in respect of non-essential cookies or certain marketing communications \u2014 we ensure that consent is freely given, specific, informed, and unambiguous. Data subjects may withdraw consent at any time without detriment.\n<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n \n <div class=\"section\" id=\"s5\">\n <div class=\"section-header\">\n <span class=\"section-num\">05<\/span>\n <h2 class=\"section-title\">Data Minimisation and; Core Principles<\/h2>\n <\/div>\n <p>We apply all seven data protection principles set out in Article 5 of the UK GDPR to every processing activity we undertake:\n<\/p>\n\n <div class=\"principles-grid\">\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\u2696\ufe0f<\/div>\n <div class=\"pc-title\">Lawfulness, Fairness & Transparency<\/div>\n <div class=\"pc-body\">We process data lawfully, fairly, and in a transparent manner. We tell individuals how and why we use their data.\n.<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83c\udfaf<\/div>\n <div class=\"pc-title\">Purpose Limitation<\/div>\n <div class=\"pc-body\">We collect data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.\n<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\u2702\ufe0f<\/div>\n <div class=\"pc-title\">Data Minimisation<\/div>\n <div class=\"pc-body\">We collect only data that is adequate, relevant, and limited to what is necessary for the stated purpose.\n<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\u2705<\/div>\n <div class=\"pc-title\">Accuracy<\/div>\n <div class=\"pc-body\">We take reasonable steps to ensure personal data is accurate and kept up to date, correcting inaccuracies promptly.<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83d\uddd3\ufe0f<\/div>\n <div class=\"pc-title\">Storage Limitation<\/div>\n <div class=\"pc-body\">We retain personal data only for as long as is necessary, governed by our documented Data Retention Schedule.\n<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83d\udd12<\/div>\n <div class=\"pc-title\">Integrity & Confidentiality<\/div>\n <div class=\"pc-body\">We implement appropriate technical and organisational measures to protect data against unauthorised access and accidental loss.<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83c\udfe2<\/div>\n <div class=\"pc-title\">Accountability<\/div>\n <div class=\"pc-body\">We are responsible for, and able to demonstrate, compliance with all of the above principles. Accountability for data protection rests at Board level.<\/div>\n <\/div>\n <\/div> <p>All new data processing activities are reviewed by our Privacy team prior to implementation to ensure compliance with these principles.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s6\">\n <div class=\"section-header\">\n <span class=\"section-num\">06<\/span>\n <h2 class=\"section-title\">Data Subject Rights<\/h2>\n <\/div>\n <p>We respect and uphold the rights of all data subjects under the UK GDPR. We have established documented procedures for handling rights requests and aim to respond to all valid requests within one (1) calendar month. We do not charge a fee for exercising rights except in cases of manifestly unfounded or excessive requests.\n<\/p>\n\n <div class=\"rights-grid\">\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\udc41\ufe0f<\/div>\n <div class=\"rc-title\">Right of Access<\/div>\n <div class=\"rc-body\">Individuals may request a copy of the personal data we hold about them (Subject Access Request).\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\u270f\ufe0f<\/div>\n <div class=\"rc-title\">Right to Rectification<\/div>\n <div class=\"rc-body\">Individuals may request correction of any inaccurate or incomplete personal data we hold.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\uddd1\ufe0f<\/div>\n <div class=\"rc-title\">Right to Erasure<\/div>\n <div class=\"rc-body\">Individuals may request deletion of their data where there is no longer a lawful basis for retention, subject to applicable legal exceptions.<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\u23f8\ufe0f<\/div>\n <div class=\"rc-title\">Right to Restriction of Processing<\/div>\n <div class=\"rc-body\">Individuals may request that we restrict processing of their data in certain defined circumstances, for example whilst the accuracy of data is contested.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\udce4<\/div>\n <div class=\"rc-title\">Right to Data Portability <\/div>\n <div class=\"rc-body\">Individuals may request their data in a structured, commonly used, and machine-readable format where processing is based on consent or contract and is carried out by automated means.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\udeab<\/div>\n <div class=\"rc-title\">Right to Object<\/div>\n <div class=\"rc-body\">Individuals may object to processing based on legitimate interests. Objections to direct marketing are always honoured immediately and without question.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83e\udd16<\/div>\n <div class=\"rc-title\">Rights in Relation to Automated Decision-Making<\/div>\n <div class=\"rc-body\">Individuals have the right not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects. BritHaven Tech does not currently carry out such processing.<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\u21a9\ufe0f<\/div>\n <div class=\"rc-title\">Right to Withdraw Consent<\/div>\n <div class=\"rc-body\">Where processing is based on consent, individuals may withdraw that consent at any time without detriment to any prior lawful processing<\/div>\n <\/div>\n <\/div>\n\n <div class=\"box blue\">\n <div class=\"bx-t\">\ud83d\udcec How to Submit a Rights Request<\/div>\n <div class=\"bx-b\">To submit a data subject rights request, please contact: privacy@brithaven.co.uk\nIf an extension beyond one month is required to respond, we will notify the individual within the first month and provide a clear explanation as to why.\n<\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s7\">\n <div class=\"section-header\">\n <span class=\"section-num\">07<\/span>\n <h2 class=\"section-title\">Data Retention<\/h2>\n <\/div>\n <p>We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law.<\/p>\n <p>All personal data is subject to our Data Retention Schedule, which defines retention periods across all data categories and is reviewed at least annually.<\/p>\n <div class=\"box grey\">\n <div class=\"bx-t\">\ud83d\udccb Retention Schedule<\/div>\n <div class=\"bx-b\">Full details of our retention periods by data category are set out in our <strong>Privacy Policy<\/strong>, which includes a comprehensive retention table covering quote data, order records, marketing data, analytics, legal claims data, and correspondence.<\/div>\n <\/div>\n <p>Our standard retention periods are as follows:\n<\/p>\n <ul>\n <li><strong>Quote request data (where no Order follows):<\/strong> 12 months from the date of the request.\n<\/li>\n <li><strong>Order and contract records: \n<\/strong> 7 years from the end of the contractual relationship, in accordance with our legal and tax obligations.\n<\/li>\n <li><strong>Marketing contact data:\n<\/strong> Until you withdraw consent or opt out, or until we determine the data is no longer relevant to our legitimate interests.<\/li>\n <li><strong>Website analytics data: \n<\/strong> Up to 26 months, in line with standard analytics practice.\n<\/li>\n<li><strong>Legal claims data: \n<\/strong> For the duration of any proceedings and up to 6 years thereafter, in accordance with the Limitation Act 1980.\n<\/li>\n<li><strong>General correspondence and emails: \n<\/strong> 3 years, for business records and dispute resolution purposes. \n<\/li>\n <\/ul>\n <p>Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our documented disposal procedures. We conduct periodic audits of retained data to ensure ongoing compliance.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s8\">\n <div class=\"section-header\">\n <span class=\"section-num\">08<\/span>\n <h2 class=\"section-title\">Data Security<\/h2>\n <\/div>\n <p>We implement appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include:\n<\/p>\n\n <div class=\"security-grid\">\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udd10<\/div>\n <div class=\"sc-title\">Encryption<\/div>\n <div class=\"sc-body\"> Data in transit is protected using SSL\/TLS encryption. Sensitive data at rest is encrypted using industry-standard protocols.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udd11<\/div>\n <div class=\"sc-title\">Access Controls<\/div>\n <div class=\"sc-body\">Access to personal data is restricted on a role-based, need-to-know basis. All staff with access to personal data are subject to appropriate confidentiality obligations.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udce1<\/div>\n <div class=\"sc-title\">Security Monitoring<\/div>\n <div class=\"sc-body\">We maintain logging and monitoring of access to systems containing personal data and conduct regular security assessments and penetration testing.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83c\udf93<\/div>\n <div class=\"sc-title\">Staff Training<\/div>\n <div class=\"sc-body\">All staff who handle personal data receive regular, role-appropriate data protection training and awareness updates.<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udea8<\/div>\n <div class=\"sc-title\">Incident Response<\/div>\n <div class=\"sc-body\">We maintain a documented Personal Data Breach Response Procedure. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO within 72 hours and affected individuals without undue delay, in accordance with Articles 33 and 34 of the UK GDPR.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83e\udd1d<\/div>\n <div class=\"sc-title\">Vendor Due Diligence<\/div>\n <div class=\"sc-body\">All third-party processors are subject to due diligence checks and are required to enter into Data Processing Agreements prior to processing any personal data on our behalf.\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s9\">\n <div class=\"section-header\">\n <span class=\"section-num\">09<\/span>\n <h2 class=\"section-title\">Third-Party Processors & Vendor Relationships<\/h2>\n <\/div><p>As a technology reseller, BritHaven Tech operates within a supply chain that involves a number of third-party Vendors and service providers. We manage these relationships as follows:\n<\/p>\n\n <div class=\"clause\">\n <div class=\"clause-label\">9.1 Sub-Processors<\/div>\n <p>Where we engage third-party processors (sub-processors) to process personal data on our behalf, we conduct appropriate due diligence and enter into written Data Processing Agreements in accordance with Article 28 of the UK GDPR. Sub-processors are permitted to process personal data only in accordance with our documented instructions and for no other purpose.\n<\/p>\n <\/div>\n\n <div class=\"clause\">\n <div class=\"clause-label\">9.2 Vendor Data Controllers<\/div>\n <p>Where our Vendor partners act as independent data controllers in respect of data shared with them \u2014 for example, to provision licences or activate cloud services \u2014 we ensure that such sharing is disclosed in our Privacy Policy and that an appropriate lawful basis exists. Clients are directed to the relevant Vendor's privacy policy for details of their own processing activities.\n<\/p>\n <\/div>\n\n <div class=\"clause\">\n <div class=\"clause-label\">9.3 Sub-Processor Register<\/div>\n <p>We maintain an internal register of all sub-processors engaged in the processing of personal data. This register is reviewed and updated periodically. Clients who have entered into a Data Processing Agreement with us may request details of our current sub-processors by contacting dpo@brithaven.co.uk\n<\/strong>.<\/p>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s10\">\n <div class=\"section-header\">\n <span class=\"section-num\">10<\/span>\n <h2 class=\"section-title\">International Data Transfers<\/h2>\n <\/div>\n <p>Where personal data is transferred outside the United Kingdom \u2014 for example, to Vendor partners or cloud service providers based in other countries \u2014 we ensure that appropriate safeguards are in place before any transfer takes place. The safeguards we rely upon include:\n<\/p>\n <ul>\n <li><strong>UK Adequacy Regulations<\/strong> where the destination country has been assessed as offering an adequate level of data protection by the UK Secretary of State.\n<\/li>\n <li><strong>UK International Data Transfer Agreement (IDTA)<\/strong> for transfers to countries without a UK adequacy decision, ensuring that equivalent protections apply contractually.\n<\/li>\n <li><strong>UK Addendum to EU Standard Contractual Clauses<\/strong> where applicable, as an alternative transfer mechanism approved by the Information Commissioner's Office (ICO).<\/li>\n <li><strong>Binding Corporate Rules (BCRs)<\/strong> where a Vendor has approved BCRs in place that cover transfers to the United Kingdom.\n<\/li>\n <\/ul>\n <p>We do not transfer personal data to countries or territories that do not offer an adequate level of protection without first implementing one of the safeguards described above. Details of the specific safeguards applicable to any transfer are available upon request from dpo@brithaven.co.uk\n<\/strong>.<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s11\">\n <div class=\"section-header\">\n <span class=\"section-num\">11<\/span>\n <h2 class=\"section-title\">Records of Processing Activities<\/h2>\n <\/div>\n <p>In accordance with Article 30 of the UK GDPR, BritHaven Tech maintains a Record of Processing Activities (RoPA). This document sets out, in respect of each processing activity:<\/p>\n <ul>\n <li>The categories of personal data processed and the categories of data subjects affected.\n<\/li>\n <li>The specific purpose of processing and the lawful basis relied upon.<\/li>\n <li>Any third-party recipients of the data, including sub-processors.\n<\/li>\n <li>Details of any international transfers and the safeguards in place.\n<\/li>\n <li>Applicable retention periods and disposal methods.\n<\/li>\n <li>A general description of the technical and organisational security measures in place.\n<\/li>\n <\/ul>\n <p>Our RoPA is reviewed and updated at least annually, and whenever a new processing activity is introduced or an existing activity is materially changed.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s12\">\n <div class=\"section-header\">\n <span class=\"section-num\">12<\/span>\n <h2 class=\"section-title\">Privacy by Design & Default<\/h2>\n <\/div>\n <p>BritHaven Tech adopts a Privacy by Design and by Default approach in accordance with Article 25 of the UK GDPR. This means that data protection considerations are embedded into the design of new systems, processes, and products from the outset, rather than being applied retrospectively.<\/p>\n<p><\/p>By default, we process only the minimum amount of personal data necessary for each specific purpose, and data is not made accessible to third parties without explicit justification. All new systems and processes undergo a privacy review prior to implementation. Our Privacy team is consulted at the design stage of any project involving personal data. Default settings across our systems are configured to collect and share the minimum data necessary.<\/p>\n<p>Data Protection Impact Assessments (DPIAs) are conducted for any processing activity that is likely to result in a high risk to the rights and freedoms of individuals.\n<\/p>\n <div class=\"box blue\">\n <div class=\"bx-t\">\ud83c\udfd7\ufe0f How We Implement This<\/div>\n <div class=\"bx-b\">All new systems and processes undergo a privacy review prior to implementation. Our Privacy team is consulted at the design stage of any project involving personal data. Default settings across our systems are configured to collect and share the minimum data necessary.<\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s13\">\n <div class=\"section-header\">\n <span class=\"section-num\">13<\/span>\n <h2 class=\"section-title\">Cookies & Electronic Marketing<\/h2>\n <\/div>\n <p>We use cookies and similar technologies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR. Non-essential cookies are only placed on users' devices with their prior, informed consent. Full details of the cookies we use and how consent is managed are set out in our Cookie Policy.\n<\/p>\n <p>In respect of electronic marketing, we comply with PECR requirements by ensuring that marketing communications are sent only to individuals who have provided prior consent, or who are existing business contacts and have not opted out, in accordance with the soft opt-in exemption for B2B communications. All marketing emails include a clear and prominent unsubscribe mechanism.<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s14\">\n <div class=\"section-header\">\n <span class=\"section-num\">14<\/span>\n <h2 class=\"section-title\">Data Protection Impact Assessments<\/h2>\n <\/div>\n <p>We conduct Data Protection Impact Assessments (DPIAs) prior to undertaking any processing that is likely to result in a high risk to the rights and freedoms of data subjects. This includes, but is not limited to:\n<\/p>\n <ul>\n <li>The introduction of new technologies or significant changes to existing systems that process personal data.\n<\/li>\n <li>Large-scale processing of personal data, particularly where special category data is involved.\n<\/li>\n <li>Systematic monitoring of individuals, including through website analytics or tracking technologies.\n<\/li>\n <li>Processing activities involving vulnerable individuals or children.\n<\/li>\n <\/ul>\n <p>Where a DPIA indicates a high residual risk that cannot be mitigated through reasonable organisational or technical measures, we consult the ICO prior to commencing the relevant processing activity, in accordance with Article 36 of the UK GDPR.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s15\">\n <div class=\"section-header\">\n <span class=\"section-num\">15<\/span>\n <h2 class=\"section-title\">Complaints & Regulatory Contact<\/h2>\n <\/div>\n <p>If you have a concern about our data protection practices, we encourage you to contact us in the first instance so that we can seek to resolve the matter directly and promptly.\n<\/p>\n\n <div class=\"contact-row\">\n <div class=\"contact-card navy\">\n <div class=\"cc-title\">BritHaven Tech Privacy Team<\/div>\n <div class=\"cc-sub\">We aim to acknowledge all complaints within two business days.<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udce7<\/div><div><strong>privacy@brithaven.co.uk<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udcde<\/div><div><strong>0800 000 0000<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udfe2<\/div><div><strong>Privacy Team, BritHaven Tech, [Company Address]<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <div class=\"contact-card grey\">\n <div class=\"cc-title\">Information Commissioner's Office<\/div>\n <div class=\"cc-sub\">We aim to acknowledge all complaints within two (2) business days and to resolve them within one (1) calendar month.\nIf you remain dissatisfied following our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection supervisory authority:\n<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udf10<\/div><div><strong>www.ico.org.uk<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udcde<\/div><div><strong>0303 123 1113<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udcee<\/div><div><strong>Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF\n<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s16\">\n <div class=\"section-header\">\n <span class=\"section-num\">16<\/span>\n <h2 class=\"section-title\">Review & Governance<\/h2>\n <\/div>\n <p>This GDPR Compliance page, together with our Privacy Policy, Cookie Policy, and associated internal documentation, is reviewed at least annually by our Privacy team and updated to reflect any changes in applicable law, regulatory guidance, or our business practices. \n<\/p>\n <p>This page was last reviewed and updated on 27 May 2025.\nBritHaven Tech's commitment to data protection is endorsed at Board level. Accountability for GDPR compliance rests with our designated Data Protection Officer \/ Privacy Contact, who reports directly to senior management and has the authority and resource necessary to carry out their responsibilities effectively.\nAn out-of-cycle review is triggered by any material change to applicable law, ICO guidance, or our processing activities.<\/p>\n <div class=\"box grey\">\n <div class=\"bx-t\">\ud83d\udcc5 Review Schedule<\/div>\n <div class=\"bx-b\">This page is reviewed annually as a minimum. It was last reviewed and updated on <strong>27 May 2025<\/strong>. An out-of-cycle review is triggered by any material change to applicable law, ICO guidance, or our processing activities.<\/div>\n <\/div>\n <\/div>\n\n <\/article>\n<\/div>\n\n<script>\nconst sections = document.querySelectorAll('.section');\nconst tocItems = document.querySelectorAll('.toc-item');\nconst observer = new IntersectionObserver((entries) => {\n entries.forEach(entry => {\n if (entry.isIntersecting) {\n const id = entry.target.id;\n tocItems.forEach(item => {\n item.classList.toggle('active', item.getAttribute('href') === '#' + id);\n });\n }\n });\n}, { rootMargin: '-80px 0px -60% 0px', threshold: 0 });\nsections.forEach(s => observer.observe(s));\ntocItems.forEach(item => {\n item.addEventListener('click', e => {\n e.preventDefault();\n const target = document.querySelector(item.getAttribute('href'));\n if (target) target.scrollIntoView({ behavior: 'smooth', block: 'start' });\n });\n});\n<\/script>\n<\/body>\n<\/html><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>GDPR Compliance \u2014 BritHaven Tech Legal & Compliance GDPR Compliance BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018. \ud83d\udcc5 Last Updated: 27 May 2025 \ud83c\udfdb\ufe0f Governing Law: England & Wales \ud83d\udee1\ufe0f Framework: UK […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-545","page","type-page","status-publish","hentry"],"yoast_head":"\n<title>GDPR-Compliance - Brithaventech<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GDPR-Compliance - Brithaventech\" \/>\n<meta property=\"og:description\" content=\"GDPR Compliance \u2014 BritHaven Tech Legal & Compliance GDPR Compliance BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018. \ud83d\udcc5 Last Updated: 27 May 2025 \ud83c\udfdb\ufe0f Governing Law: England & Wales \ud83d\udee1\ufe0f Framework: UK […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"Brithaventech\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-01T11:29:11+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"22 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/\",\"url\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/\",\"name\":\"GDPR-Compliance - Brithaventech\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/#website\"},\"datePublished\":\"2026-05-30T07:43:59+00:00\",\"dateModified\":\"2026-06-01T11:29:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/brithaventech.co.uk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GDPR-Compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/#website\",\"url\":\"https:\\\/\\\/brithaventech.co.uk\\\/\",\"name\":\"Brithaventech\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/brithaventech.co.uk\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n","yoast_head_json":{"title":"GDPR-Compliance - Brithaventech","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","og_locale":"en_US","og_type":"article","og_title":"GDPR-Compliance - Brithaventech","og_description":"GDPR Compliance \u2014 BritHaven Tech Legal & Compliance GDPR Compliance BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018. \ud83d\udcc5 Last Updated: 27 May 2025 \ud83c\udfdb\ufe0f Governing Law: England & Wales \ud83d\udee1\ufe0f Framework: UK […]","og_url":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","og_site_name":"Brithaventech","article_modified_time":"2026-06-01T11:29:11+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"22 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","url":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","name":"GDPR-Compliance - Brithaventech","isPartOf":{"@id":"https:\/\/brithaventech.co.uk\/#website"},"datePublished":"2026-05-30T07:43:59+00:00","dateModified":"2026-06-01T11:29:11+00:00","breadcrumb":{"@id":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/brithaventech.co.uk\/"},{"@type":"ListItem","position":2,"name":"GDPR-Compliance"}]},{"@type":"WebSite","@id":"https:\/\/brithaventech.co.uk\/#website","url":"https:\/\/brithaventech.co.uk\/","name":"Brithaventech","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/brithaventech.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=545"}],"version-history":[{"count":19,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/545\/revisions"}],"predecessor-version":[{"id":835,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/545\/revisions\/835"}],"wp:attachment":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

\n\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t

\n\t\t\t\t\t\t

\n\t\t\t\t\t\t\t

\n\n\n\n\nGDPR Compliance \u2014 BritHaven Tech<\/title>\n<link rel=\"preconnect\" href=\"https:\/\/fonts.googleapis.com\">\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Montserrat:wght@400;500;600;700;800&family=Poppins:wght@300;400;500;600;700&display=swap\" rel=\"stylesheet\">\n<style>\n*{box-sizing:border-box;margin:0;padding:0}\n:root{\n --ink:#0A0F1E;--navy:#0C1A4B;--navy2:#112266;--blue:#1547E8;--blue2:#0F39C8;\n --blue-lt:#EBF0FF;--sky:#E8F0FE;--white:#FFFFFF;\n --g50:#F7F8FC;--g100:#EDEEF4;--g200:#D8DAE8;--g400:#9BA3BF;--g600:#5C6480;--g700:#3A405A;\n --green:#0B7A45;--green-lt:#E6F5EE;--green-bd:#b7dfc9;\n --amber:#92400E;--amber-lt:#FFF8ED;--amber-bd:#F5D78B;\n --shadow-xs:0 1px 2px rgba(10,15,30,.06);--shadow-sm:0 2px 8px rgba(10,15,30,.08);\n --shadow-md:0 6px 20px rgba(10,15,30,.1);\n --r4:4px;--r6:6px;--r8:8px;--r10:10px;--r12:12px;--r16:16px;\n}\nbody{font-family:'Poppins',sans-serif;background:var(--white);color:var(--ink);line-height:1.6;font-size:14px}\n\n\/* \u2500\u2500 HERO \u2500\u2500 *\/\n.page-hero{background:var(--navy);padding:52px 24px;position:relative;overflow:hidden}\n.page-hero::before{content:'';position:absolute;inset:0;background:radial-gradient(ellipse 60% 120% at 85% 50%,rgba(21,71,232,.3) 0%,transparent 70%);pointer-events:none}\n.page-hero::after{content:'';position:absolute;bottom:-1px;left:0;right:0;height:40px;background:linear-gradient(to bottom,transparent,#fff);pointer-events:none;display:none}\n.ph-inner{max-width:1200px;margin:0 auto;position:relative;z-index:1}\n.ph-flag{display:inline-flex;align-items:center;gap:8px;padding:4px 14px;background:rgba(255,255,255,.08);border:1px solid rgba(255,255,255,.15);border-radius:20px;font-size:11px;font-weight:600;color:rgba(255,255,255,.8);letter-spacing:.04em;text-transform:uppercase;margin-bottom:16px}\n.ph-title{font-family:'Montserrat',sans-serif;font-size:32px;font-weight:800;color:#fff;line-height:1.15;letter-spacing:-.03em;margin-bottom:10px}\n.ph-sub{font-size:13.5px;color:rgba(255,255,255,.6);max-width:640px;line-height:1.8}\n.ph-meta{display:flex;gap:24px;margin-top:22px;flex-wrap:wrap}\n.ph-meta-item{font-size:11.5px;color:rgba(255,255,255,.5);display:flex;align-items:center;gap:6px}\n.ph-meta-item strong{color:rgba(255,255,255,.8);font-weight:600}\n\n\/* \u2500\u2500 COMPLIANCE STRIP \u2500\u2500 *\/\n.compliance-strip{background:var(--navy2);border-bottom:1px solid rgba(255,255,255,.06);padding:0 24px}\n.cs-inner{max-width:1200px;margin:0 auto;display:flex;gap:0;overflow-x:visible;flex-wrap:wrap;justify-content:center}\n.cs-item{display:flex;align-items:center;gap:9px;padding:13px 18px;font-size:12px;font-weight:600;color:rgba(255,255,255,.6);border-right:1px solid rgba(255,255,255,.06);white-space:normal;flex-shrink:0}\n.cs-item:first-child{padding-left:18px}\n.cs-dot{width:7px;height:7px;border-radius:50%;background:var(--green);flex-shrink:0;box-shadow:0 0 6px rgba(11,122,69,.6)}\n\n\/* \u2500\u2500 LAYOUT \u2500\u2500 *\/\n.layout{max-width:1200px;margin:0 auto;padding:24px 24px 44px;display:grid;grid-template-columns:248px 1fr;gap:44px;align-items:start}\n\n\/* \u2500\u2500 TOC \u2500\u2500 *\/\n.toc{position:sticky;top:84px}\n.toc-label{font-size:10px;font-weight:700;color:var(--g400);text-transform:uppercase;letter-spacing:.09em;margin-bottom:10px;padding:0 10px}\n.toc-title{font-size:10.5px;font-weight:700;color:var(--navy);text-transform:uppercase;letter-spacing:.09em;margin-bottom:14px;padding-bottom:8px;border-bottom:2px solid var(--blue)}\n.toc-item{display:block;padding:6px 10px;font-size:12px;color:var(--g600);cursor:pointer;border-radius:var(--r6);transition:all .15s;text-decoration:none;border-left:2px solid transparent;margin-bottom:2px;line-height:1.4}\n.toc-item:hover{background:var(--g50);color:var(--blue)}\n.toc-item.active{background:var(--blue-lt);color:var(--blue);border-left-color:var(--blue);font-weight:600}\n.toc-num{font-size:10px;color:var(--g400);margin-right:4px;font-weight:700}\n.toc-divider{height:1px;background:var(--g100);margin:12px 0}\n\n\/* \u2500\u2500 DOCUMENT \u2500\u2500 *\/\n.doc{min-width:0}\n\n.doc-intro{background:var(--g50);border:1.5px solid var(--g200);border-radius:var(--r12);padding:20px 22px;margin-bottom:36px}\n.di-title{font-family:'Montserrat',sans-serif;font-size:14px;font-weight:700;color:var(--navy);margin-bottom:6px}\n.di-body{font-size:13px;color:var(--g700);line-height:1.8}\n\n.section{margin-bottom:44px;scroll-margin-top:100px}\n.section-header{display:flex;align-items:center;gap:12px;margin-bottom:20px;padding-bottom:12px;border-bottom:2px solid var(--g100)}\n.section-num{font-family:'Montserrat',sans-serif;font-size:11px;font-weight:800;color:var(--blue);background:var(--blue-lt);padding:3px 9px;border-radius:4px;letter-spacing:.04em;flex-shrink:0}\n.section-title{font-family:'Montserrat',sans-serif;font-size:17px;font-weight:700;color:var(--navy);letter-spacing:-.02em}\n\n.doc p{font-size:13.5px;color:var(--g700);line-height:1.8;margin-bottom:14px}\n.doc p:last-child{margin-bottom:0}\n\n.clause{margin-bottom:22px}\n.clause-label{font-size:12px;font-weight:700;color:var(--navy);text-transform:uppercase;letter-spacing:.06em;margin-bottom:8px;display:flex;align-items:center;gap:7px}\n.clause p{font-size:13px;color:var(--g700);line-height:1.8;margin-bottom:0}\n\n.doc ul,.doc ol{padding-left:20px;margin:10px 0 14px}\n.doc ul li,.doc ol li{font-size:13px;color:var(--g700);line-height:1.8;margin-bottom:7px;padding-left:4px}\n.doc ul li strong,.doc ol li strong{color:var(--navy)}\n\n\/* \u2500\u2500 INFO BOXES \u2500\u2500 *\/\n.box{border-radius:var(--r10);padding:16px 20px;margin:16px 0}\n.box.blue{background:var(--blue-lt);border:1px solid rgba(21,71,232,.18)}\n.box.blue .bx-t{color:var(--blue2)}.box.blue .bx-b{color:var(--blue2)}\n.box.green{background:var(--green-lt);border:1px solid var(--green-bd)}\n.box.green .bx-t{color:var(--green)}.box.green .bx-b{color:#155c35}\n.box.amber{background:var(--amber-lt);border:1px solid var(--amber-bd)}\n.box.amber .bx-t{color:var(--amber)}.box.amber .bx-b{color:var(--amber)}\n.box.grey{background:var(--g50);border:1.5px solid var(--g200)}\n.box.grey .bx-t{color:var(--navy)}.box.grey .bx-b{color:var(--g700)}\n.bx-t{font-size:11.5px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;margin-bottom:7px}\n.bx-b{font-size:13px;line-height:1.75}\n\n\/* \u2500\u2500 PRINCIPLES GRID \u2500\u2500 *\/\n.principles-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px;margin:18px 0}\n.principle-card{background:#fff;border:1.5px solid var(--g100);border-radius:var(--r10);padding:16px;transition:border-color .2s,box-shadow .2s}\n.principle-card:hover{border-color:var(--blue);box-shadow:var(--shadow-sm)}\n.pc-icon{font-size:22px;margin-bottom:9px}\n.pc-title{font-size:12.5px;font-weight:700;color:var(--navy);margin-bottom:5px}\n.pc-body{font-size:12px;color:var(--g600);line-height:1.65}\n\n\/* \u2500\u2500 LAWFUL BASIS TABLE \u2500\u2500 *\/\n.basis-table{width:100%;border-collapse:collapse;margin:16px 0;font-size:12.5px}\n.basis-table th{background:var(--navy);color:#fff;padding:10px 14px;text-align:left;font-weight:600;font-size:11px;text-transform:uppercase;letter-spacing:.05em}\n.basis-table th:first-child{border-radius:var(--r6) 0 0 0}\n.basis-table th:last-child{border-radius:0 var(--r6) 0 0}\n.basis-table td{padding:10px 14px;border-bottom:1px solid var(--g100);color:var(--g700);line-height:1.6;vertical-align:top}\n.basis-table tr:last-child td{border-bottom:none}\n.basis-table tr:nth-child(even) td{background:var(--g50)}\n.basis-table td:first-child{font-weight:700;color:var(--navy);white-space:nowrap}\n.art-ref{display:inline-block;padding:1px 7px;background:var(--blue-lt);color:var(--blue2);border-radius:3px;font-size:10.5px;font-weight:700;white-space:nowrap}\n\n\/* \u2500\u2500 RIGHTS GRID \u2500\u2500 *\/\n.rights-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px;margin:18px 0}\n.right-card{background:#fff;border:1.5px solid var(--g100);border-radius:var(--r10);padding:16px;transition:border-color .2s,box-shadow .2s}\n.right-card:hover{border-color:var(--blue);box-shadow:var(--shadow-sm)}\n.rc-icon{font-size:20px;margin-bottom:8px}\n.rc-title{font-size:12.5px;font-weight:700;color:var(--navy);margin-bottom:5px}\n.rc-body{font-size:12px;color:var(--g600);line-height:1.65}\n\n\/* \u2500\u2500 SECURITY GRID \u2500\u2500 *\/\n.security-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:12px;margin:18px 0}\n.sec-card{background:var(--navy);border-radius:var(--r10);padding:18px;color:#fff}\n.sc-icon{font-size:22px;margin-bottom:10px}\n.sc-title{font-size:12.5px;font-weight:700;color:#fff;margin-bottom:6px}\n.sc-body{font-size:12px;color:rgba(255,255,255,.6);line-height:1.65}\n\n\/* \u2500\u2500 CONTACT CARDS \u2500\u2500 *\/\n.contact-row{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-top:20px}\n.contact-card{border-radius:var(--r12);padding:20px}\n.contact-card.navy{background:var(--navy)}\n.contact-card.grey{background:var(--g50);border:1.5px solid var(--g200)}\n.cc-title{font-family:'Montserrat',sans-serif;font-size:14px;font-weight:700;margin-bottom:4px}\n.contact-card.navy .cc-title{color:#fff}\n.contact-card.grey .cc-title{color:var(--navy)}\n.cc-sub{font-size:12px;margin-bottom:14px;line-height:1.6}\n.contact-card.navy .cc-sub{color:rgba(255,255,255,.5)}\n.contact-card.grey .cc-sub{color:var(--g600)}\n.cc-items{display:flex;flex-direction:column;gap:8px}\n.cc-item{font-size:12.5px;display:flex;align-items:flex-start;gap:8px;line-height:1.5}\n.contact-card.navy .cc-item{color:rgba(255,255,255,.7)}\n.contact-card.navy .cc-item strong{color:#fff}\n.contact-card.grey .cc-item{color:var(--g700)}\n.contact-card.grey .cc-item strong{color:var(--navy)}\n.cc-icon{width:26px;height:26px;border-radius:var(--r6);display:flex;align-items:center;justify-content:center;font-size:12px;flex-shrink:0;margin-top:1px}\n.contact-card.navy .cc-icon{background:rgba(255,255,255,.08)}\n.contact-card.grey .cc-icon{background:var(--g100)}\n\n@media(max-width:900px){\n .layout{grid-template-columns:1fr}\n .toc{display:none}\n .contact-row{grid-template-columns:1fr}\n .principles-grid,.rights-grid,.security-grid{grid-template-columns:1fr 1fr}\n}\n@media(max-width:580px){\n .principles-grid,.rights-grid,.security-grid{grid-template-columns:1fr}\n .cs-inner{gap:0;flex-direction:column;align-items:flex-start}\n .cs-item{width:100%;border-right:none;border-bottom:1px solid rgba(255,255,255,.06);padding:12px 0}\n .cs-item:first-child{padding-left:0}\n}\n\n\/* ===================================================\n BRITHAVEN FONT OVERRIDE\n Headings = Montserrat\n Paragraph\/content = Poppins\n =================================================== *\/\nh1,h2,h3,h4,h5,h6,\n.logo-mark,\n.logo-text,\n.ph-title,\n.di-title,\n.section-num,\n.section-title,\n.cc-title,\n.pc-title,\n.rc-title,\n.sc-title,\n.clause-label,\n.bx-t,\n.toc-title,\n.tb-badge,\n.art-ref{\n font-family:'Montserrat',sans-serif !important;\n}\n\nbody,\np,\nspan,\ndiv,\nli,\ntd,\nth,\ninput,\ntextarea,\nbutton,\n.ph-sub,\n.di-body,\n.pc-body,\n.rc-body,\n.sc-body,\n.bx-b,\n.cc-sub,\n.cc-item,\n.toc-item,\n.doc p,\n.doc li{\n font-family:'Poppins',sans-serif !important;\n}\n\n<\/style>\n<\/head>\n<body>\n\n\n<section class=\"page-hero\">\n <div class=\"ph-inner\">\n <div class=\"ph-flag\"> Legal & Compliance<\/div>\n <h1 class=\"ph-title\">GDPR Compliance<\/h1>\n <p class=\"ph-sub\">BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018.<\/p>\n <div class=\"ph-meta\">\n <div class=\"ph-meta-item\">\ud83d\udcc5 <strong>Last Updated:<\/strong> 27 May 2025<\/div>\n <div class=\"ph-meta-item\">\ud83c\udfdb\ufe0f <strong>Governing Law:<\/strong> England & Wales<\/div>\n <div class=\"ph-meta-item\">\ud83d\udee1\ufe0f <strong>Framework:<\/strong> UK GDPR \u00b7 DPA 2018 \u00b7 PECR<\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n<div class=\"compliance-strip\">\n <div class=\"cs-inner\">\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> UK GDPR Compliant<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> Data Protection Act 2018<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> ICO Registered<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> Privacy by Design<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> DPA Agreements in Place<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> PECR Compliant<\/div>\n <div class=\"cs-item\"><span class=\"cs-dot\"><\/span> Annual Review<\/div>\n <\/div>\n<\/div>\n\n\n<div class=\"layout\">\n\n \n <nav class=\"toc\">\n <div class=\"toc-title\">Contents<\/div>\n <a class=\"toc-item active\" href=\"#s1\"><span class=\"toc-num\">01<\/span> Our Commitment<\/a>\n <a class=\"toc-item\" href=\"#s2\"><span class=\"toc-num\">02<\/span> Legal Framework<\/a>\n <a class=\"toc-item\" href=\"#s3\"><span class=\"toc-num\">03<\/span> Data Controller Role<\/a>\n <a class=\"toc-item\" href=\"#s4\"><span class=\"toc-num\">04<\/span> Lawful Bases<\/a>\n <a class=\"toc-item\" href=\"#s5\"><span class=\"toc-num\">05<\/span> Data Principles<\/a>\n <a class=\"toc-item\" href=\"#s6\"><span class=\"toc-num\">06<\/span> Data Subject Rights<\/a>\n <a class=\"toc-item\" href=\"#s7\"><span class=\"toc-num\">07<\/span> Data Retention<\/a>\n <a class=\"toc-item\" href=\"#s8\"><span class=\"toc-num\">08<\/span> Data Security<\/a>\n <a class=\"toc-item\" href=\"#s9\"><span class=\"toc-num\">09<\/span> Third-Party Processors<\/a>\n <a class=\"toc-item\" href=\"#s10\"><span class=\"toc-num\">10<\/span> International Transfers<\/a>\n <a class=\"toc-item\" href=\"#s11\"><span class=\"toc-num\">11<\/span> Records of Processing<\/a>\n <a class=\"toc-item\" href=\"#s12\"><span class=\"toc-num\">12<\/span> Privacy by Design<\/a>\n <a class=\"toc-item\" href=\"#s13\"><span class=\"toc-num\">13<\/span> Cookies & Marketing<\/a>\n <a class=\"toc-item\" href=\"#s14\"><span class=\"toc-num\">14<\/span> DPIAs<\/a>\n <a class=\"toc-item\" href=\"#s15\"><span class=\"toc-num\">15<\/span> Complaints & Contact<\/a>\n <a class=\"toc-item\" href=\"#s16\"><span class=\"toc-num\">16<\/span> Review & Governance<\/a>\n <\/nav>\n\n \n <article class=\"doc\">\n\n <div class=\"doc-intro\">\n <div class=\"di-title\">About This Page<\/div>\n <div class=\"di-body\">TThis page sets out BritHaven Tech Limited's approach to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It is intended to provide transparency about our data protection practices and to help our clients, partners, and website visitors understand how we uphold their rights.\n<\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s1\">\n <div class=\"section-header\">\n <span class=\"section-num\">01<\/span>\n <h2 class=\"section-title\">Our Commitment to Data Protection<\/h2>\n <\/div>\n <p>BritHaven Tech Limited is committed to processing personal data responsibly, lawfully, and transparently. As an authorised UK technology reseller, we handle personal data in the course of our day-to-day commercial activities, including managing client accounts, processing orders, and operating our website.<\/p>\n<p>We recognise that data protection is not merely a legal obligation but a fundamental aspect of the trust our clients and partners place in us. We are committed to embedding a culture of privacy across our organisation and to continually reviewing and improving our data protection practices.\nWe do not sell personal data. We process only what is necessary. We are transparent about how and why we process data. We uphold the rights of every individual whose data we handle.\n<\/p>\n <div class=\"box green\">\n <div class=\"bx-t\">\u2705 Our Core Pledge<\/div>\n <div class=\"bx-b\">We do not sell personal data. We process only what is necessary. We are transparent about how and why we process data. We uphold the rights of every individual whose data we handle.<\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s2\">\n <div class=\"section-header\">\n <span class=\"section-num\">02<\/span>\n <h2 class=\"section-title\">Our Legal Framework<\/h2>\n <\/div>\n <p>BritHaven Tech Limited processes personal data in accordance with the following legislation and regulatory guidance:\n<\/p>\n <ul>\n <li><strong>the primary legislative framework governing the processing of personal data in the United Kingdom following the UK's exit from the European Union.\n<\/li>\n <li><strong>Data Protection Act 2018 (DPA 2018)<\/strong> \u2014 the UK statute that supplements and gives effect to the UK GDPR and governs certain processing activities not covered by it.\n<\/li>\n <li><strong>Privacy and Electronic Communications Regulations 2003 (PECR)<\/strong> \u2014 which govern electronic marketing, the use of cookies, and related communications.\n<\/li>\n <li><strong>Network and Information Systems (NIS) Regulations 2018<\/strong> \u2014 relevant to our obligations as a technology service provider in respect of cybersecurity and incident reporting.\n<\/li>\n <\/ul>\n <p>We monitor regulatory guidance issued by the Information Commissioner's Office (ICO) and update our practices accordingly.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s3\">\n <div class=\"section-header\">\n <span class=\"section-num\">03<\/span>\n <h2 class=\"section-title\">Our Role as Data Controller<\/h2>\n <\/div>\n <p>BritHaven Tech Limited acts as the data controller in respect of personal data collected through our website, quote request process, and direct commercial relationships. As data controller, we determine the purposes and means of processing and bear \n<\/p>\n <p>primary responsibility for ensuring that processing is lawful.\nIn certain circumstances \u2014 for example, where we process personal data on behalf of a client organisation \u2014 we may act as a data processor. In such cases, processing is governed by a written Data Processing Agreement (DPA) in accordance with Article 28 of the UK GDPR.<\/p>\n <div class=\"contact-row\">\n <div class=\"contact-card navy\">\n <div class=\"cc-title\">Data Protection Officer \/ Privacy Contact:\n<\/div>\n <div class=\"cc-sub\">Contact our DPO for all data protection matters.<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udce7<\/div><div><strong>dpo@brithaven.co.uk<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udfe2<\/div><div><strong>Data Protection Officer, BritHaven Tech Limited, [Company Address], England<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <div class=\"contact-card grey\">\n <div class=\"cc-title\">ICO Registration<\/div>\n <div class=\"cc-sub\">BritHaven Tech is registered with the ICO as a data controller.<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udd22<\/div><div>ICO Registration Number:<strong>[Z0000000]<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udf10<\/div><div><strong>ico.org.uk<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s4\">\n <div class=\"section-header\">\n <span class=\"section-num\">04<\/span>\n <h2 class=\"section-title\">Lawful Bases for Processing<\/h2>\n <\/div>\n <p>We process personal data only where we have identified a valid lawful basis under Article 6 of the UK GDPR. The lawful bases we rely upon are as follows:<\/p>\n\n <table class=\"basis-table\">\n <thead>\n <tr>\n <th>Lawful Basis<\/th>\n <th>Article Ref.<\/th>\n <th>How We Use It<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td>Performance of a Contract<\/td>\n <td><span class=\"art-ref\">Article 6(1)(b)<\/span><\/td>\n <td>We process personal data where it is necessary to perform a contract to which the data subject is party, or to take steps at their request prior to entering into a contract. This applies to the processing of client contact details, order information, invoice management, and account administration.\n<\/td>\n <\/tr>\n <tr>\n <td>Legitimate Interests<\/td>\n <td><span class=\"art-ref\">Article 6(1)(f)<\/span><\/td>\n <td>We process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by the rights and freedoms of the data subject. We conduct Legitimate Interests Assessments (LIAs) in respect of all processing activities where this basis is relied upon, including direct marketing to existing business contacts and website analytics.\n<\/td>\n <\/tr>\n <tr>\n <td>Legal Obligation<\/td>\n <td><span class=\"art-ref\">Article 6(1)(c)<\/span><\/td>\n <td>We process personal data where necessary to comply with a legal obligation to which we are subject, including tax reporting, VAT record-keeping, anti-money laundering checks, and compliance with court orders or regulatory requirements.\n<\/td>\n <\/tr>\n <tr>\n <td>Consent<\/td>\n <td><span class=\"art-ref\">Article 6(1)(a)<\/span><\/td>\n <td>Where we rely on consent \u2014 for example, in respect of non-essential cookies or certain marketing communications \u2014 we ensure that consent is freely given, specific, informed, and unambiguous. Data subjects may withdraw consent at any time without detriment.\n<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n \n <div class=\"section\" id=\"s5\">\n <div class=\"section-header\">\n <span class=\"section-num\">05<\/span>\n <h2 class=\"section-title\">Data Minimisation and; Core Principles<\/h2>\n <\/div>\n <p>We apply all seven data protection principles set out in Article 5 of the UK GDPR to every processing activity we undertake:\n<\/p>\n\n <div class=\"principles-grid\">\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\u2696\ufe0f<\/div>\n <div class=\"pc-title\">Lawfulness, Fairness & Transparency<\/div>\n <div class=\"pc-body\">We process data lawfully, fairly, and in a transparent manner. We tell individuals how and why we use their data.\n.<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83c\udfaf<\/div>\n <div class=\"pc-title\">Purpose Limitation<\/div>\n <div class=\"pc-body\">We collect data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.\n<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\u2702\ufe0f<\/div>\n <div class=\"pc-title\">Data Minimisation<\/div>\n <div class=\"pc-body\">We collect only data that is adequate, relevant, and limited to what is necessary for the stated purpose.\n<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\u2705<\/div>\n <div class=\"pc-title\">Accuracy<\/div>\n <div class=\"pc-body\">We take reasonable steps to ensure personal data is accurate and kept up to date, correcting inaccuracies promptly.<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83d\uddd3\ufe0f<\/div>\n <div class=\"pc-title\">Storage Limitation<\/div>\n <div class=\"pc-body\">We retain personal data only for as long as is necessary, governed by our documented Data Retention Schedule.\n<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83d\udd12<\/div>\n <div class=\"pc-title\">Integrity & Confidentiality<\/div>\n <div class=\"pc-body\">We implement appropriate technical and organisational measures to protect data against unauthorised access and accidental loss.<\/div>\n <\/div>\n <div class=\"principle-card\">\n <div class=\"pc-icon\">\ud83c\udfe2<\/div>\n <div class=\"pc-title\">Accountability<\/div>\n <div class=\"pc-body\">We are responsible for, and able to demonstrate, compliance with all of the above principles. Accountability for data protection rests at Board level.<\/div>\n <\/div>\n <\/div> <p>All new data processing activities are reviewed by our Privacy team prior to implementation to ensure compliance with these principles.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s6\">\n <div class=\"section-header\">\n <span class=\"section-num\">06<\/span>\n <h2 class=\"section-title\">Data Subject Rights<\/h2>\n <\/div>\n <p>We respect and uphold the rights of all data subjects under the UK GDPR. We have established documented procedures for handling rights requests and aim to respond to all valid requests within one (1) calendar month. We do not charge a fee for exercising rights except in cases of manifestly unfounded or excessive requests.\n<\/p>\n\n <div class=\"rights-grid\">\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\udc41\ufe0f<\/div>\n <div class=\"rc-title\">Right of Access<\/div>\n <div class=\"rc-body\">Individuals may request a copy of the personal data we hold about them (Subject Access Request).\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\u270f\ufe0f<\/div>\n <div class=\"rc-title\">Right to Rectification<\/div>\n <div class=\"rc-body\">Individuals may request correction of any inaccurate or incomplete personal data we hold.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\uddd1\ufe0f<\/div>\n <div class=\"rc-title\">Right to Erasure<\/div>\n <div class=\"rc-body\">Individuals may request deletion of their data where there is no longer a lawful basis for retention, subject to applicable legal exceptions.<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\u23f8\ufe0f<\/div>\n <div class=\"rc-title\">Right to Restriction of Processing<\/div>\n <div class=\"rc-body\">Individuals may request that we restrict processing of their data in certain defined circumstances, for example whilst the accuracy of data is contested.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\udce4<\/div>\n <div class=\"rc-title\">Right to Data Portability <\/div>\n <div class=\"rc-body\">Individuals may request their data in a structured, commonly used, and machine-readable format where processing is based on consent or contract and is carried out by automated means.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83d\udeab<\/div>\n <div class=\"rc-title\">Right to Object<\/div>\n <div class=\"rc-body\">Individuals may object to processing based on legitimate interests. Objections to direct marketing are always honoured immediately and without question.\n<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\ud83e\udd16<\/div>\n <div class=\"rc-title\">Rights in Relation to Automated Decision-Making<\/div>\n <div class=\"rc-body\">Individuals have the right not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects. BritHaven Tech does not currently carry out such processing.<\/div>\n <\/div>\n <div class=\"right-card\">\n <div class=\"rc-icon\">\u21a9\ufe0f<\/div>\n <div class=\"rc-title\">Right to Withdraw Consent<\/div>\n <div class=\"rc-body\">Where processing is based on consent, individuals may withdraw that consent at any time without detriment to any prior lawful processing<\/div>\n <\/div>\n <\/div>\n\n <div class=\"box blue\">\n <div class=\"bx-t\">\ud83d\udcec How to Submit a Rights Request<\/div>\n <div class=\"bx-b\">To submit a data subject rights request, please contact: privacy@brithaven.co.uk\nIf an extension beyond one month is required to respond, we will notify the individual within the first month and provide a clear explanation as to why.\n<\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s7\">\n <div class=\"section-header\">\n <span class=\"section-num\">07<\/span>\n <h2 class=\"section-title\">Data Retention<\/h2>\n <\/div>\n <p>We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law.<\/p>\n <p>All personal data is subject to our Data Retention Schedule, which defines retention periods across all data categories and is reviewed at least annually.<\/p>\n <div class=\"box grey\">\n <div class=\"bx-t\">\ud83d\udccb Retention Schedule<\/div>\n <div class=\"bx-b\">Full details of our retention periods by data category are set out in our <strong>Privacy Policy<\/strong>, which includes a comprehensive retention table covering quote data, order records, marketing data, analytics, legal claims data, and correspondence.<\/div>\n <\/div>\n <p>Our standard retention periods are as follows:\n<\/p>\n <ul>\n <li><strong>Quote request data (where no Order follows):<\/strong> 12 months from the date of the request.\n<\/li>\n <li><strong>Order and contract records: \n<\/strong> 7 years from the end of the contractual relationship, in accordance with our legal and tax obligations.\n<\/li>\n <li><strong>Marketing contact data:\n<\/strong> Until you withdraw consent or opt out, or until we determine the data is no longer relevant to our legitimate interests.<\/li>\n <li><strong>Website analytics data: \n<\/strong> Up to 26 months, in line with standard analytics practice.\n<\/li>\n<li><strong>Legal claims data: \n<\/strong> For the duration of any proceedings and up to 6 years thereafter, in accordance with the Limitation Act 1980.\n<\/li>\n<li><strong>General correspondence and emails: \n<\/strong> 3 years, for business records and dispute resolution purposes. \n<\/li>\n <\/ul>\n <p>Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our documented disposal procedures. We conduct periodic audits of retained data to ensure ongoing compliance.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s8\">\n <div class=\"section-header\">\n <span class=\"section-num\">08<\/span>\n <h2 class=\"section-title\">Data Security<\/h2>\n <\/div>\n <p>We implement appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include:\n<\/p>\n\n <div class=\"security-grid\">\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udd10<\/div>\n <div class=\"sc-title\">Encryption<\/div>\n <div class=\"sc-body\"> Data in transit is protected using SSL\/TLS encryption. Sensitive data at rest is encrypted using industry-standard protocols.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udd11<\/div>\n <div class=\"sc-title\">Access Controls<\/div>\n <div class=\"sc-body\">Access to personal data is restricted on a role-based, need-to-know basis. All staff with access to personal data are subject to appropriate confidentiality obligations.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udce1<\/div>\n <div class=\"sc-title\">Security Monitoring<\/div>\n <div class=\"sc-body\">We maintain logging and monitoring of access to systems containing personal data and conduct regular security assessments and penetration testing.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83c\udf93<\/div>\n <div class=\"sc-title\">Staff Training<\/div>\n <div class=\"sc-body\">All staff who handle personal data receive regular, role-appropriate data protection training and awareness updates.<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83d\udea8<\/div>\n <div class=\"sc-title\">Incident Response<\/div>\n <div class=\"sc-body\">We maintain a documented Personal Data Breach Response Procedure. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO within 72 hours and affected individuals without undue delay, in accordance with Articles 33 and 34 of the UK GDPR.\n<\/div>\n <\/div>\n <div class=\"sec-card\">\n <div class=\"sc-icon\">\ud83e\udd1d<\/div>\n <div class=\"sc-title\">Vendor Due Diligence<\/div>\n <div class=\"sc-body\">All third-party processors are subject to due diligence checks and are required to enter into Data Processing Agreements prior to processing any personal data on our behalf.\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s9\">\n <div class=\"section-header\">\n <span class=\"section-num\">09<\/span>\n <h2 class=\"section-title\">Third-Party Processors & Vendor Relationships<\/h2>\n <\/div><p>As a technology reseller, BritHaven Tech operates within a supply chain that involves a number of third-party Vendors and service providers. We manage these relationships as follows:\n<\/p>\n\n <div class=\"clause\">\n <div class=\"clause-label\">9.1 Sub-Processors<\/div>\n <p>Where we engage third-party processors (sub-processors) to process personal data on our behalf, we conduct appropriate due diligence and enter into written Data Processing Agreements in accordance with Article 28 of the UK GDPR. Sub-processors are permitted to process personal data only in accordance with our documented instructions and for no other purpose.\n<\/p>\n <\/div>\n\n <div class=\"clause\">\n <div class=\"clause-label\">9.2 Vendor Data Controllers<\/div>\n <p>Where our Vendor partners act as independent data controllers in respect of data shared with them \u2014 for example, to provision licences or activate cloud services \u2014 we ensure that such sharing is disclosed in our Privacy Policy and that an appropriate lawful basis exists. Clients are directed to the relevant Vendor's privacy policy for details of their own processing activities.\n<\/p>\n <\/div>\n\n <div class=\"clause\">\n <div class=\"clause-label\">9.3 Sub-Processor Register<\/div>\n <p>We maintain an internal register of all sub-processors engaged in the processing of personal data. This register is reviewed and updated periodically. Clients who have entered into a Data Processing Agreement with us may request details of our current sub-processors by contacting dpo@brithaven.co.uk\n<\/strong>.<\/p>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s10\">\n <div class=\"section-header\">\n <span class=\"section-num\">10<\/span>\n <h2 class=\"section-title\">International Data Transfers<\/h2>\n <\/div>\n <p>Where personal data is transferred outside the United Kingdom \u2014 for example, to Vendor partners or cloud service providers based in other countries \u2014 we ensure that appropriate safeguards are in place before any transfer takes place. The safeguards we rely upon include:\n<\/p>\n <ul>\n <li><strong>UK Adequacy Regulations<\/strong> where the destination country has been assessed as offering an adequate level of data protection by the UK Secretary of State.\n<\/li>\n <li><strong>UK International Data Transfer Agreement (IDTA)<\/strong> for transfers to countries without a UK adequacy decision, ensuring that equivalent protections apply contractually.\n<\/li>\n <li><strong>UK Addendum to EU Standard Contractual Clauses<\/strong> where applicable, as an alternative transfer mechanism approved by the Information Commissioner's Office (ICO).<\/li>\n <li><strong>Binding Corporate Rules (BCRs)<\/strong> where a Vendor has approved BCRs in place that cover transfers to the United Kingdom.\n<\/li>\n <\/ul>\n <p>We do not transfer personal data to countries or territories that do not offer an adequate level of protection without first implementing one of the safeguards described above. Details of the specific safeguards applicable to any transfer are available upon request from dpo@brithaven.co.uk\n<\/strong>.<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s11\">\n <div class=\"section-header\">\n <span class=\"section-num\">11<\/span>\n <h2 class=\"section-title\">Records of Processing Activities<\/h2>\n <\/div>\n <p>In accordance with Article 30 of the UK GDPR, BritHaven Tech maintains a Record of Processing Activities (RoPA). This document sets out, in respect of each processing activity:<\/p>\n <ul>\n <li>The categories of personal data processed and the categories of data subjects affected.\n<\/li>\n <li>The specific purpose of processing and the lawful basis relied upon.<\/li>\n <li>Any third-party recipients of the data, including sub-processors.\n<\/li>\n <li>Details of any international transfers and the safeguards in place.\n<\/li>\n <li>Applicable retention periods and disposal methods.\n<\/li>\n <li>A general description of the technical and organisational security measures in place.\n<\/li>\n <\/ul>\n <p>Our RoPA is reviewed and updated at least annually, and whenever a new processing activity is introduced or an existing activity is materially changed.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s12\">\n <div class=\"section-header\">\n <span class=\"section-num\">12<\/span>\n <h2 class=\"section-title\">Privacy by Design & Default<\/h2>\n <\/div>\n <p>BritHaven Tech adopts a Privacy by Design and by Default approach in accordance with Article 25 of the UK GDPR. This means that data protection considerations are embedded into the design of new systems, processes, and products from the outset, rather than being applied retrospectively.<\/p>\n<p><\/p>By default, we process only the minimum amount of personal data necessary for each specific purpose, and data is not made accessible to third parties without explicit justification. All new systems and processes undergo a privacy review prior to implementation. Our Privacy team is consulted at the design stage of any project involving personal data. Default settings across our systems are configured to collect and share the minimum data necessary.<\/p>\n<p>Data Protection Impact Assessments (DPIAs) are conducted for any processing activity that is likely to result in a high risk to the rights and freedoms of individuals.\n<\/p>\n <div class=\"box blue\">\n <div class=\"bx-t\">\ud83c\udfd7\ufe0f How We Implement This<\/div>\n <div class=\"bx-b\">All new systems and processes undergo a privacy review prior to implementation. Our Privacy team is consulted at the design stage of any project involving personal data. Default settings across our systems are configured to collect and share the minimum data necessary.<\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s13\">\n <div class=\"section-header\">\n <span class=\"section-num\">13<\/span>\n <h2 class=\"section-title\">Cookies & Electronic Marketing<\/h2>\n <\/div>\n <p>We use cookies and similar technologies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR. Non-essential cookies are only placed on users' devices with their prior, informed consent. Full details of the cookies we use and how consent is managed are set out in our Cookie Policy.\n<\/p>\n <p>In respect of electronic marketing, we comply with PECR requirements by ensuring that marketing communications are sent only to individuals who have provided prior consent, or who are existing business contacts and have not opted out, in accordance with the soft opt-in exemption for B2B communications. All marketing emails include a clear and prominent unsubscribe mechanism.<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s14\">\n <div class=\"section-header\">\n <span class=\"section-num\">14<\/span>\n <h2 class=\"section-title\">Data Protection Impact Assessments<\/h2>\n <\/div>\n <p>We conduct Data Protection Impact Assessments (DPIAs) prior to undertaking any processing that is likely to result in a high risk to the rights and freedoms of data subjects. This includes, but is not limited to:\n<\/p>\n <ul>\n <li>The introduction of new technologies or significant changes to existing systems that process personal data.\n<\/li>\n <li>Large-scale processing of personal data, particularly where special category data is involved.\n<\/li>\n <li>Systematic monitoring of individuals, including through website analytics or tracking technologies.\n<\/li>\n <li>Processing activities involving vulnerable individuals or children.\n<\/li>\n <\/ul>\n <p>Where a DPIA indicates a high residual risk that cannot be mitigated through reasonable organisational or technical measures, we consult the ICO prior to commencing the relevant processing activity, in accordance with Article 36 of the UK GDPR.\n<\/p>\n <\/div>\n\n \n <div class=\"section\" id=\"s15\">\n <div class=\"section-header\">\n <span class=\"section-num\">15<\/span>\n <h2 class=\"section-title\">Complaints & Regulatory Contact<\/h2>\n <\/div>\n <p>If you have a concern about our data protection practices, we encourage you to contact us in the first instance so that we can seek to resolve the matter directly and promptly.\n<\/p>\n\n <div class=\"contact-row\">\n <div class=\"contact-card navy\">\n <div class=\"cc-title\">BritHaven Tech Privacy Team<\/div>\n <div class=\"cc-sub\">We aim to acknowledge all complaints within two business days.<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udce7<\/div><div><strong>privacy@brithaven.co.uk<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udcde<\/div><div><strong>0800 000 0000<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udfe2<\/div><div><strong>Privacy Team, BritHaven Tech, [Company Address]<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <div class=\"contact-card grey\">\n <div class=\"cc-title\">Information Commissioner's Office<\/div>\n <div class=\"cc-sub\">We aim to acknowledge all complaints within two (2) business days and to resolve them within one (1) calendar month.\nIf you remain dissatisfied following our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection supervisory authority:\n<\/div>\n <div class=\"cc-items\">\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83c\udf10<\/div><div><strong>www.ico.org.uk<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udcde<\/div><div><strong>0303 123 1113<\/strong><\/div><\/div>\n <div class=\"cc-item\"><div class=\"cc-icon\">\ud83d\udcee<\/div><div><strong>Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF\n<\/strong><\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n \n <div class=\"section\" id=\"s16\">\n <div class=\"section-header\">\n <span class=\"section-num\">16<\/span>\n <h2 class=\"section-title\">Review & Governance<\/h2>\n <\/div>\n <p>This GDPR Compliance page, together with our Privacy Policy, Cookie Policy, and associated internal documentation, is reviewed at least annually by our Privacy team and updated to reflect any changes in applicable law, regulatory guidance, or our business practices. \n<\/p>\n <p>This page was last reviewed and updated on 27 May 2025.\nBritHaven Tech's commitment to data protection is endorsed at Board level. Accountability for GDPR compliance rests with our designated Data Protection Officer \/ Privacy Contact, who reports directly to senior management and has the authority and resource necessary to carry out their responsibilities effectively.\nAn out-of-cycle review is triggered by any material change to applicable law, ICO guidance, or our processing activities.<\/p>\n <div class=\"box grey\">\n <div class=\"bx-t\">\ud83d\udcc5 Review Schedule<\/div>\n <div class=\"bx-b\">This page is reviewed annually as a minimum. It was last reviewed and updated on <strong>27 May 2025<\/strong>. An out-of-cycle review is triggered by any material change to applicable law, ICO guidance, or our processing activities.<\/div>\n <\/div>\n <\/div>\n\n <\/article>\n<\/div>\n\n<script>\nconst sections = document.querySelectorAll('.section');\nconst tocItems = document.querySelectorAll('.toc-item');\nconst observer = new IntersectionObserver((entries) => {\n entries.forEach(entry => {\n if (entry.isIntersecting) {\n const id = entry.target.id;\n tocItems.forEach(item => {\n item.classList.toggle('active', item.getAttribute('href') === '#' + id);\n });\n }\n });\n}, { rootMargin: '-80px 0px -60% 0px', threshold: 0 });\nsections.forEach(s => observer.observe(s));\ntocItems.forEach(item => {\n item.addEventListener('click', e => {\n e.preventDefault();\n const target = document.querySelector(item.getAttribute('href'));\n if (target) target.scrollIntoView({ behavior: 'smooth', block: 'start' });\n });\n});\n<\/script>\n<\/body>\n<\/html><\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>GDPR Compliance \u2014 BritHaven Tech Legal & Compliance GDPR Compliance BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018. \ud83d\udcc5 Last Updated: 27 May 2025 \ud83c\udfdb\ufe0f Governing Law: England & Wales \ud83d\udee1\ufe0f Framework: UK […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-545","page","type-page","status-publish","hentry"],"yoast_head":"\n<title>GDPR-Compliance - Brithaventech<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GDPR-Compliance - Brithaventech\" \/>\n<meta property=\"og:description\" content=\"GDPR Compliance \u2014 BritHaven Tech Legal & Compliance GDPR Compliance BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018. \ud83d\udcc5 Last Updated: 27 May 2025 \ud83c\udfdb\ufe0f Governing Law: England & Wales \ud83d\udee1\ufe0f Framework: UK […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"Brithaventech\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-01T11:29:11+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"22 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/\",\"url\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/\",\"name\":\"GDPR-Compliance - Brithaventech\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/#website\"},\"datePublished\":\"2026-05-30T07:43:59+00:00\",\"dateModified\":\"2026-06-01T11:29:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/index.php\\\/gdpr-compliance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/brithaventech.co.uk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GDPR-Compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/brithaventech.co.uk\\\/#website\",\"url\":\"https:\\\/\\\/brithaventech.co.uk\\\/\",\"name\":\"Brithaventech\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/brithaventech.co.uk\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n","yoast_head_json":{"title":"GDPR-Compliance - Brithaventech","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","og_locale":"en_US","og_type":"article","og_title":"GDPR-Compliance - Brithaventech","og_description":"GDPR Compliance \u2014 BritHaven Tech Legal & Compliance GDPR Compliance BritHaven Tech is committed to processing personal data responsibly, lawfully, and transparently. This page sets out our approach to compliance with the UK GDPR and the Data Protection Act 2018. \ud83d\udcc5 Last Updated: 27 May 2025 \ud83c\udfdb\ufe0f Governing Law: England & Wales \ud83d\udee1\ufe0f Framework: UK […]","og_url":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","og_site_name":"Brithaventech","article_modified_time":"2026-06-01T11:29:11+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"22 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","url":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/","name":"GDPR-Compliance - Brithaventech","isPartOf":{"@id":"https:\/\/brithaventech.co.uk\/#website"},"datePublished":"2026-05-30T07:43:59+00:00","dateModified":"2026-06-01T11:29:11+00:00","breadcrumb":{"@id":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/brithaventech.co.uk\/index.php\/gdpr-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/brithaventech.co.uk\/"},{"@type":"ListItem","position":2,"name":"GDPR-Compliance"}]},{"@type":"WebSite","@id":"https:\/\/brithaventech.co.uk\/#website","url":"https:\/\/brithaventech.co.uk\/","name":"Brithaventech","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/brithaventech.co.uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=545"}],"version-history":[{"count":19,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/545\/revisions"}],"predecessor-version":[{"id":835,"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/545\/revisions\/835"}],"wp:attachment":[{"href":"https:\/\/brithaventech.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}