Data Protection Policy

Infinitus Consulting UK

ICO Registration Number: C1651313

1. Introduction

Infinitus Consulting UK (“we,” “our,” “us”) is committed to ensuring the protection of personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy outlines our approach to data protection, ensuring we handle personal data lawfully, fairly, and transparently.

2. Scope

This policy applies to all employees, contractors, and third parties handling personal data on behalf of Infinitus Consulting UK. It covers the processing of all personal data received from clients, employees, and third parties.

3. Data Protection Principles

Infinitus Consulting UK adheres to the following principles:

  • Lawfulness, fairness, and transparency – Personal data is processed lawfully, fairly, and transparently.
  • Purpose limitation – Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
  • Data minimisation – Only necessary data is collected and processed.
  • Accuracy – Data is kept accurate and up to date.
  • Storage limitation – Data is retained only for as long as necessary.
  • Integrity and confidentiality – Data is processed securely to prevent unauthorised access, loss, or destruction.

4. Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Consent of the data subject
  • Performance of a contract
  • Compliance with a legal obligation
  • Legitimate interests pursued by Infinitus Consulting UK

5. Data Subject Rights

Data subjects have the right to:

  • Access their personal data
  • Rectify inaccurate or incomplete data
  • Request erasure of their data
  • Restrict processing of their data
  • Object to data processing
  • Data portability

Requests should be directed to our Data Protection Officer.

6. Data Security

We implement technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access. These measures include:

  • Encryption of sensitive data
  • Access controls and authentication measures
  • Secure data storage and disposal practices
  • Regular staff training on data protection

7. Data Breach Management

In the event of a data breach, we will:

  • Assess the breach and contain it
  • Notify affected individuals and the ICO where necessary
  • Take corrective action to prevent recurrence

8. Third-Party Data Sharing

Personal data may be shared with third-party service providers, regulatory authorities, or other parties where legally required or for legitimate business purposes. Contracts with third parties ensure data is processed securely and in compliance with data protection laws.

9. Policy Review

This policy is reviewed annually or as required to ensure compliance with legal and regulatory changes.

10. Contact Information

For any queries regarding this policy, please contact our Data Protection Officer.

Last Updated: February 2025