GDPR / Data Protection Policy

1.Purpose

This policy sets out how Build Your Vision Ltd ("the Company") complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 when operating People Hub and running the Company's own business. It applies to all directors, employees, contractors, and third parties who process personal data on the Company's behalf.

It covers personal data the Company processes as data controller (e.g. about its own staff, customers, and prospects) and personal data it processes as data processor on behalf of People Hub customers (Employee Data belonging to the Customer's own employees).

2.Data Protection Principles

The Company adheres to the six data protection principles set out in Article 5 of UK GDPR. Personal data must be:

• Processed lawfully, fairly, and in a transparent manner ("lawfulness, fairness and transparency").
• Collected for specified, explicit, and legitimate purposes, and not further processed in a way incompatible with those purposes ("purpose limitation").
• Adequate, relevant, and limited to what is necessary ("data minimisation").
• Accurate and kept up to date, with inaccurate data corrected or erased without delay ("accuracy").
• Kept in a form permitting identification for no longer than necessary ("storage limitation").
• Processed in a manner ensuring appropriate security, including protection against unauthorised or unlawful processing and against loss, destruction, or damage ("integrity and confidentiality").

The Company is responsible for, and must be able to demonstrate compliance with, these principles ("accountability").

3.Roles and Responsibilities

Data Protection Lead: [name or role · to be confirmed] is responsible for overseeing this policy, acting as the first point of contact for data protection queries, managing data subject requests and breach response, and maintaining the Company's records of processing activities.

Directors: responsible for resourcing data protection compliance and ensuring this policy is embedded in business decisions, including new features and third-party integrations.

All staff and contractors: responsible for handling personal data in line with this policy, completing data protection training, and reporting suspected breaches or data subject requests to the Data Protection Lead immediately.

4.Lawful Basis for Processing

Before processing personal data, the Company identifies and documents an appropriate lawful basis under Article 6 UK GDPR (and, for special category data such as health information, an additional Article 9 condition). Typical bases used by the Company include:

• Contract — processing necessary to provide the Service to Customers and to manage employment relationships with the Company's own staff.
• Legal obligation — e.g. tax, payroll, and employment law record-keeping.
• Legitimate interests — e.g. product improvement, fraud prevention, direct marketing to business contacts (balanced against individuals' rights via a legitimate interests assessment).
• Consent — used where required, e.g. certain marketing communications or optional cookies, and recorded so it can be evidenced and withdrawn.

Where the Company processes special category data as a processor on a Customer's instructions (e.g. Employee Data medical forms), the Customer as controller is responsible for identifying its own Article 6 and Article 9 basis; the Company processes that data only as instructed and under the terms of the Data Processing Agreement.

5.Data Subject Rights

Individuals have the right to: be informed about processing; access their personal data; rectify inaccurate data; erasure in certain circumstances; restrict processing; data portability; object to processing; and rights related to automated decision-making and profiling (the Service does not currently use automated decision-making with legal or similarly significant effect).

5.1Requests relating to Company data (as controller): any request received from a customer contact, prospect, job applicant, or the Company's own staff should be forwarded to the Data Protection Lead immediately. The Company will verify the requester's identity, respond within one calendar month (extendable by two further months for complex requests, with the requester informed of the extension and reason), and log the request and outcome.

5.2Requests relating to Employee Data (as processor): if the Company receives a request from an individual whose data was submitted by a Customer (e.g. an employee of a Customer business), staff must not action the request directly. It should be logged and referred to the relevant Customer without delay, in line with the Data Processing Agreement, as the Customer — not the Company — is the controller responsible for responding.

6.Special Category Data

People Hub enables Customers to store special category data about their employees, including health information (e.g. medical forms, sickness/absence records) and, potentially, other categories such as data revealing trade union membership if a Customer chooses to record it. The Company:

• processes such data only as instructed by the relevant Customer, and only to the extent necessary to provide the Service;
• applies enhanced access controls so that special category data is visible only to appropriately permissioned roles within a Customer's account (e.g. manager-level access for medical forms, not general employee visibility);
• does not use special category data for the Company's own analytics, marketing, or product training purposes without explicit agreement;
• ensures relevant staff who may access such data (e.g. support staff assisting with a Customer issue) are trained on its sensitivity.

7.Data Security

The Company applies technical and organisational measures appropriate to the risk, including: encryption of data in transit and at rest; role-based access controls and the principle of least privilege; multi-factor authentication for staff access to production systems; regular access reviews; secure software development practices; logging and monitoring; and vendor due diligence for any sub-processor.

Staff must not store personal data on personal devices or unapproved third-party tools, and must follow the Company's access control and password policies. See the Company's Information Security Policy.

8.Data Retention

The Company retains personal data only for as long as necessary for the purposes it was collected, in line with the retention periods set out in the Company's Privacy Policy and, for Customer Employee Data, the Data Processing Agreement. A retention schedule should be maintained and reviewed periodically, covering at minimum: Customer account and billing records, marketing contact data, HR records for the Company's own staff, and Employee Data processed on behalf of Customers (including post-termination export and deletion timelines).

9.Data Breach Reporting and Response

9.1Any suspected or actual personal data breach — including unauthorised access, accidental disclosure, loss of a device containing personal data, or a security incident affecting the Service — must be reported to the Data Protection Lead immediately, and in any event within 24 hours of discovery.

9.2The Data Protection Lead will assess the breach, contain it where possible, and determine whether it is likely to result in a risk to individuals' rights and freedoms.

9.3Where a breach is notifiable, the Company will report it to the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 UK GDPR.

9.4Where a breach is likely to result in a high risk to affected individuals, the Company will notify those individuals without undue delay, in accordance with Article 34 UK GDPR.

9.5Where a breach involves Employee Data processed on behalf of a Customer, the Company will notify the affected Customer without undue delay, in accordance with the Data Processing Agreement, to enable the Customer to meet its own controller obligations.

9.6All breaches, whether notifiable or not, are logged in the Company's data breach register, including facts, effects, and remedial action taken.

10.Third Parties and Sub-processors

The Company only engages third-party service providers (e.g. hosting, payment processing, email delivery) who provide sufficient guarantees of appropriate technical and organisational measures, under a written contract containing data protection terms compliant with Article 28 UK GDPR. Customers are notified of, and may raise objections to, material changes in sub-processors in accordance with the Data Processing Agreement. A current sub-processor list is maintained at Annex 3 of the Data Processing Agreement.

11.International Data Transfers

Where personal data is transferred outside the UK (e.g. to a sub-processor's servers), the Company ensures an appropriate transfer mechanism is in place, such as an adequacy decision, the UK International Data Transfer Agreement, or UK-recognised Standard Contractual Clauses, together with a transfer risk assessment where required.

12.Data Protection Impact Assessments (DPIAs)

The Company carries out a DPIA before introducing new processing that is likely to result in high risk to individuals — for example, a new feature that processes additional special category data, introduces automated decision-making, or involves large-scale monitoring. DPIAs are reviewed by the Data Protection Lead and, where residual risk remains high, the ICO may be consulted before processing begins.

13.Training and Awareness

All staff and contractors with access to personal data receive data protection training as part of onboarding and at least annually thereafter, covering this policy, secure handling of personal data (including special category data), and how to recognise and report a suspected breach or data subject request.

14.Records of Processing Activities

The Company maintains a record of processing activities (ROPA) as required under Article 30 UK GDPR, documenting the purposes of processing, categories of data subjects and personal data, recipients, retention periods, and security measures for each processing activity, reviewed at least annually and updated when processing changes.

15.Policy Review

This policy is reviewed at least annually, or sooner if there is a material change in law, guidance from the ICO, or the Company's processing activities, and is approved by [director or role · to be confirmed] before adoption.

16.Contact

Questions about this policy, or to report a data protection concern, should be directed to:

Build Your Vision Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Data Protection Lead: [name · to be confirmed] — Email: info@buildyourvision.co.uk
Website: byvpeoplehub.com