GDPR
Policy
1. Purpose of this policy
This policy outlines how Splashcloud Consultancy (SCC) processes, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all employees, contractors, and associates working for or on behalf of SCC.
2. Scope
This policy covers:
- All personal data processed by SCC
- All systems, applications, and services used for processing
- All remote workers, regardless of location
- All client data, internal employee data, and supplier data
3. Data Protection Principles
SCC adheres to the following principles:
- Lawfulness, fairness, transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
4. Lawful Basis for Processing
SCC processes personal data under one or more lawful bases:
- Contractual necessity
- Legal obligation
- Legitimate interests
- Consent (where explicitly required)
A Record of Processing Activities (ROPA) is maintained to document these bases.
5. Roles and Responsibilities
Data Controller
Splashcloud Consultancy acts as the Data Controller for internal data and may act as a Data Processor or Joint Controller for client data depending only when specifically agreed in contract terms..
Data Protection Committee
A designated committee within SCC oversees compliance, responds to data subject requests, and manages incidents.
Employees and Contractors
All remote workers and contractors must follow this policy and complete regular data protection training.
6. Remote Working Requirements
Because SCC operates as a remote consultancy, the following controls apply to all staff:
6.1 Device & System Security
All devices used for SCC work must be secured with strong authentication
Operating systems and software must be kept up to date
Anti‑malware protection must be active
Devices must auto‑lock after a short period of inactivity
6.2 Access Controls
Access to SCC systems is granted on a least‑privilege basis
Multi‑factor authentication (MFA) is required for all SCC accounts
Only SCC‑approved accounts and platforms may be used for storing or processing SCC data
6.3 Data Storage
Personal data must be stored only within SCC‑approved cloud platforms (e.g., Microsoft 365, SharePoint, OneDrive for Business)
Local storage of personal data should be avoided unless explicitly authorised
External storage devices must not be used unless encrypted, approved and explicitly authorised
6.4 Network Security
Employees must use secure, password‑protected Wi‑Fi
Public Wi‑Fi may only be used when connected through an SCC‑approved VPN
7. Data Handling Requirements
7.1 Data Minimisation
Only the minimum necessary personal data should be collected and processed by SCC.
7.2 Data Sharing
Personal data may only be shared:
- With authorised SCC colleagues
- With approved third‑party processors under contract
- When legally required
7.3 Data Retention
Data is retained only for as long as necessary. SCC maintains a retention schedule covering:
- HR data
- Client project data
- Financial and contractual records
7.3 Data Disposal
When data is no longer required:
- Digital data must be securely deleted
- Paper records (if any) must be securely destroyed
8. Data Subject Rights
SCC supports all rights under UK GDPR, including:
- Right to access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
Requests must be acknowledged within one month.
9. Data Breach Management
All employees must report suspected or actual data breaches immediately to the SCC Data Protection Committee.
SCC will:
- Investigate within 24 hours
- Assess risk to individuals
- Notify the ICO within 72 hours if required
- Notify affected individuals when necessary
A breach log is maintained for all incidents.
10. Third-Party Processers
Splashcloud Consultancy ensures all third‑party suppliers:
- Are GDPR compliant
- Sign Data Processing Agreements (DPAs)
- Provide adequate security measures
This includes cloud platforms, CRM systems, communication tools, and subcontractors.
11. International Data Transfers
Personal data is not transferred outside the UK unless:
- Adequate safeguards are in place
- Standard Contractual Clauses (SCCs) or UK Addendum are used
- The transfer is legally permitted
12. Training and Awareness
All SCC employees must complete:
- GDPR training on induction
- Regular refresher training
- Additional training when policies or systems change
13. Policy Review
This policy is reviewed regularly or specifically when:
- Legislation changes
- SCC business operations change
- New systems or processes are introduced