GDPR compliance procedures

• Requests can be made informally by emailing Nedim@sitesafesolution.co.uk. No form is required.
• We confirm the requester's identity before releasing any data.
• We respond within one calendar month. If a request is complex we may extend by up to two further months, and we'll say so within the first month.
• This covers all UK GDPR rights: access, rectification, erasure, restriction, portability and objection.

• Any suspected breach is assessed immediately upon discovery.
• Where a breach is likely to result in a risk to people's rights and freedoms, we notify the Information Commissioner's Office within 72 hours of becoming aware.
• Where the risk to individuals is high, we also inform the people affected without undue delay.
• Every breach, notifiable or not, is recorded with its causes and the action taken to prevent recurrence.

We keep a record of the personal data we process: what it is, why we hold it, where it is stored, who it is shared with and how long we keep it. The record is reviewed alongside the data protection policy.

Before taking on a new tool, supplier or type of processing, we consider the data protection impact first: whether the data is needed at all, where it will be stored, and what could go wrong. Higher-risk processing gets a documented assessment before it starts.

Suppliers that process personal data for us (such as hosting and email providers) are used under contracts containing the processor obligations the UK GDPR requires, and we choose providers with appropriate security measures and, where relevant, appropriate international transfer safeguards.

Anyone unhappy with how we handle their data can contact us at Nedim@sitesafesolution.co.uk, and has the right to complain to the Information Commissioner's Office at ico.org.uk.