Data Management and Data Governance Policy.

1. Purpose

• We are required by law to comply with UK GDPR and PECR.
• We follow good practice to protect clients, staff and other individuals.
• We protect the organisation by managing data responsibly.

2. Types of data

Data may include name, email address, position within the company, telephone contact details, details of business interest, and full company information. Emertec does not intentionally collect special category data. If such data is ever received, it will be minimised and protected appropriately.

3. Legal basis for processing data

• Consent — e.g. newsletter sign-ups; easy to withdraw at any time.
• Contract — to provide services or take steps at your request.
• Legal obligation — e.g. accounting rules.
• Legitimate interests — B2B communications and sales follow-ups where appropriate.

Emertec documents the lawful basis for each processing activity and informs individuals through clear privacy information. Where consent is relied upon, it is freely given, specific, informed, and easy to withdraw.

4. Policy statement — your rights

• The right to access personal data
• The right to rectification
• The right to erasure (where applicable)
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

We respond to valid requests within one month. We are open and honest with individuals whose data is held. All personnel employed by or contracted to Emertec are trained in good data handling practices.

5. Security and location

• All Emertec data is stored within secure cloud-based platforms.
• We use Microsoft 365 (Outlook, OneDrive, SharePoint) for email and document storage.
• We use Monday.com as our CRM.
• We use Xero for financial and invoicing data.
• These providers supply their own enterprise-grade security measures, including encryption, access control, and continuous monitoring.
• Access to all systems is strictly role-based with strong authentication.
• No data is stored on local servers or firewalls operated by Emertec.

6. Data retention

We keep personal data only for as long as necessary. See the Data Retention Schedule below for specific periods. When a period ends, data is securely deleted or anonymised.

7. Data sharing and transfers

• Emertec does not sell personal data.
• We may share data with trusted service providers acting as processors (Microsoft, Monday.com, Xero) or where required by law.
• Where data is transferred outside the UK, Standard Contractual Clauses (SCCs) apply.
• SCCs are automatically provided and managed by Microsoft, Monday.com, and Xero as part of their Data Processing Agreements.

8. Data breach management

A personal data breach is any accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to personal data.

• All staff must immediately report suspected breaches to the Data Protection Lead (DPL).
• Incidents are logged and investigated within 24 hours.
• We assess risk to individuals and, if required, report notifiable breaches to the ICO within 72 hours and notify affected individuals without undue delay.
• Post-incident reviews are conducted to prevent recurrence.

9. Governance and accountability

• Maintain Records of Processing Activities (ROPA).
• Review this policy annually or after significant changes.
• Conduct Data Protection Impact Assessments (DPIAs) where required.
• Appoint a Data Protection Lead (contact below).
• Provide and record staff training.

10. Privacy notices

We provide clear privacy information explaining:

• What we collect: name, email address, job role, company name, company address, business number
• Why we collect it
• How we use it
• How long it is kept
• Who it may be shared with
• International transfers and safeguards
• How individuals can exercise their rights

For customers, accounting information is stored in Xero and can be updated or deleted upon request.

11. Contact details

For data protection enquiries, contact the Data Protection Lead at sales@emertec.co.uk.

Individuals may also complain to the UK Information Commissioner’s Office (ICO).

Appendices

A. Data breach procedure

• Recognise: any loss, unauthorised access, disclosure, or alteration of personal data.
• Report: immediately notify the DPL with facts (what, when, whose data).
• Respond: DPL logs, investigates within 24 hours, and contains the issue.
• Assess: risk to individuals; decide on ICO/individual notification.
• Recover: fix root cause; document lessons learned.

B. Data retention schedule

C. Website privacy notice

Who we are: Emertec Limited (contact: sales@emertec.co.uk)

• Data we collect: name, work contact details, company info, and website usage data.
• Why: respond to enquiries, deliver services, improve our site, and send updates (with consent).
• Sharing: trusted providers (hosting, CRM, email). We do not sell data.
• Your rights: access, rectification, erasure, restriction, objection, portability.
• How long: see the Data Retention Schedule.

D. PECR cookie policy

We use essential cookies for site operation, analytics cookies to understand usage, and marketing cookies only with your consent. You can control non-essential cookies via the cookie banner and your browser settings. Analytics/marketing cookies only run after you click Accept.

E. Records of Processing Activities (ROPA) — template

• Controller: Emertec Limited; contact: sales@emertec.co.uk
• CRM & sales — lawful basis: legitimate interests/contract; retention: 3 years inactivity
• Marketing — lawful basis: consent; retention: until unsubscribed
• Invoicing — lawful basis: legal obligation; retention: 6 years
• Website analytics — lawful basis: consent; retention per provider settings