Data Processing Policy (UK GDPR)

Depending on the service, personal data may include:

• full name

• email address

• phone number

• address (optional)

• business name/job title (optional)

• online identifiers (e.g., cookie IDs, ad identifiers) where applicable and lawfully obtained

• any other data a client provides for service delivery

Special Category Data

We do not request or intentionally process special category data (e.g., health, ethnicity, religion) unless:

• it is strictly necessary,

• documented and approved in advance, and

• additional safeguards are implemented.

We collect personal data from:

• clients (as controller) where we act as a processor

• individuals directly (e.g., enquiry forms) where we act as controller

• systems used to deliver services (e.g., email, CRM, ad platforms), where lawfully configured

We only collect data that is necessary for a defined purpose.

We use personal data for:

• delivering contracted services

• communications and project administration

• marketing campaign setup and management (where instructed)

• reporting and analytics (using aggregated or pseudonymised data where possible)

• legal, compliance, and security purposes

We do not sell personal data.

We only share personal data:

• where necessary to provide services

• with approved subprocessors

• under appropriate contractual safeguards

Approved Subprocessors (examples – tailor to your business)

• Microsoft

• Google Ireland Ltd (Google Ads / Customer Match where instructed)

• Meta Platforms Ireland Ltd (Facebook/Instagram Custom Audiences where instructed)

Any additional subprocessors must be vetted for security and compliance and, where we act as a processor, approved by the client as required.

If personal data is transferred outside the UK (and/or EEA), we ensure appropriate safeguards are in place, such as:

• UK International Data Transfer Agreement (IDTA) and/or

• UK Addendum to EU Standard Contractual Clauses, plus any required supplementary measures.

Transfers are assessed and documented where required.

We implement technical and organisational measures appropriate to risk, which may include:

Access control

• unique user accounts, strong passwords, MFA where available

• role-based access / least privilege

Data handling

• secure file sharing methods (no open/public links unless required and time-limited)

• encryption in transit; encryption at rest where supported by systems used

• controlled use of USB/removable media

Device and account security

• device lock, updates, anti-malware, and secure configuration

• account monitoring and logging where available

Operational controls

• staff confidentiality obligations

• regular training and awareness

• supplier due diligence

• secure disposal of data and equipment

We keep personal data only as long as necessary for the purpose it was collected.

• Where we act as a processor, we delete/return data on the client’s instruction or at contract end, unless required by law.

• Where we act as a data controller, we retain personal data only for as long as necessary and in line with our retention schedule. Retention periods vary depending on the type of data and the purpose for which it is processed. For more information, please see our privacy policy

Individuals may have rights including:

• access, rectification, erasure

• restriction, portability

• objection (including to direct marketing)

• rights related to automated decision-making (where applicable)

Requests should be sent to: info@universalcomputing.co.uk
We will verify identity and respond within statutory timeframes. If we are acting as a processor, we will promptly notify the relevant controller/client and assist as required.

A personal data breach includes accidental/unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Internal reporting: Any suspected breach must be reported immediately to info@universalcomputing.co.uk or 01383 840808 opt 3

Client notification (processor scenarios): Where we process data for a client, we will notify the client without undue delay and in any event within 48 hours of becoming aware of a breach affecting their data, including:

• what happened and when

• what data may be affected

• likely impacts

• containment and mitigation steps

Where required, we will support notifications to the ICO and affected individuals.

• Staff receive appropriate data protection training.

• We review this policy at least annually and after material changes (such as new systems, subprocessors, incidents, or legal updates).

For questions, concerns, or rights requests:

Email: info@universalcomputing.co.uk
Address: Universal Computing Ltd, 24 Guildhall St, Dunfermline, Fife, KY127NS