Data Protection Policy
1. Introduction
Trusted Conveyancing Limited (“the Organisation”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal data. This Data Protection Policy explains how we collect, use, store, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies to all employees, contractors, volunteers, and any other individuals who process personal data on behalf of the Organisation.
2. Purpose of This Policy
The purpose of this policy is to:
Ensure compliance with UK data protection law
Protect the rights and freedoms of individuals whose data we process
Set out clear responsibilities for handling personal data
Reduce the risk of data breaches and misuse of personal data
3. Scope
This policy applies to:
All personal data processed by the Organisation, whether in electronic, paper, or other form
All processing activities carried out by or on behalf of the Organisation
4. Definitions
Personal data: Any information relating to an identified or identifiable living individual.
Special category data: Personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or sexual orientation.
Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
Data subject: The individual to whom the personal data relates.
5. Data Protection Principles
We process personal data in accordance with the following UK GDPR principles:
Lawfulness, fairness and transparency – Data is processed lawfully, fairly, and in a transparent manner.
Purpose limitation – Data is collected for specified, explicit, and legitimate purposes only.
Data minimisation – Data is adequate, relevant, and limited to what is necessary.
Accuracy – Data is accurate and, where necessary, kept up to date.
Storage limitation – Data is kept no longer than necessary.
Integrity and confidentiality – Data is processed securely and protected against unauthorised access, loss, or damage.
Accountability – We take responsibility for compliance with data protection law.
6. Lawful Bases for Processing
We only process personal data where at least one lawful basis applies, including:
Consent
Performance of a contract
Compliance with a legal obligation
Protection of vital interests
Performance of a task in the public interest
Legitimate interests (where these do not override individuals’ rights)
Special category data is processed only where an additional lawful condition applies.
7. Data Subject Rights
Individuals have the following rights under UK GDPR:
The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision-making and profiling
Requests to exercise these rights should be made to either email: office@trustedconveyancing.com or write to Trusted Conveyancing
8. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
Access controls and authentication
Secure storage and encryption where appropriate
Staff training on data protection
Regular review of security measures
All staff must handle personal data in accordance with this policy and related procedures.
9. Data Sharing
Personal data may be shared with third parties where necessary and lawful, including:
Service providers and processors
Regulatory or law enforcement bodies
Professional advisers
All third parties are required to process personal data securely and in compliance with data protection law.
10. International Data Transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:
Adequacy regulations
International data transfer agreements
Other approved safeguards under UK GDPR
11. Data Retention
Personal data is retained only for as long as necessary for the purpose for which it was collected, in accordance with our data retention schedule. Data is securely deleted or destroyed when no longer required.
12. Data Breaches
All personal data breaches must be reported immediately to [Data Protection Officer / responsible person]. We will investigate breaches promptly and report them to the Information Commissioner’s Office (ICO) and affected individuals where required by law.
13. Responsibilities
Senior management is responsible for ensuring compliance with this policy.
Employees and contractors must comply with this policy and complete relevant training.
Anna Jones oversees data protection compliance and acts as the main contact for data protection matters.
14. Complaints
If an individual has concerns about how we handle personal data, they should contact us in the first instance. Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
15. Review and Updates
This policy will be reviewed regularly and updated as necessary to reflect changes in law or organisational practices.
Last updated: 5th February 2026