GDPR Compliance

1. Our Commitment

Trading name notice: ATTFT Finding Technology is the trading name used in our products and services. The registered legal entity is ATTFT Limited (Company No. 15102834), incorporated in England and Wales.

ATTFT Limited is committed to protecting the personal data of our website visitors, clients, and the end users of systems we build. As a company registered in England and Wales and operating under SIC 63110 (Data Processing, Hosting, and Related Activities), data protection is not an afterthought it is central to how we operate.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our Privacy Policy provides full details of how we handle personal data.

2. Data Protection Principles

We adhere to the six data protection principles under UK GDPR, processing personal data:

• Lawfully, fairly, and transparently we always have a valid legal basis and tell people how we use their data.
• For specified, explicit, and legitimate purposes we only use data for the purpose for which it was collected.
• With data minimisation we collect only what is necessary.
• With accuracy we keep data up to date and correct errors promptly.
• With storage limitation we do not retain data longer than necessary.
• With integrity and confidentiality we implement appropriate security measures to protect data.

As a data controller, ATTFT is also responsible for and can demonstrate compliance with these principles (accountability).

3. Lawful Bases for Processing

We rely on the following lawful bases depending on the context:

• Contract: processing your data to deliver services you have requested or entered a contract for.
• Legitimate interests: operating our business, responding to enquiries, improving our services balanced against your rights.
• Legal obligation: compliance with tax, employment, and other regulatory requirements.
• Consent: for marketing communications always freely given, specific, and withdrawable.

We maintain a Record of Processing Activities (RoPA) documenting all processing activities, lawful bases, data categories, and retention periods.

4. Data Subject Rights

We respect and facilitate all rights under UK GDPR. Individuals have the right to:

• Access their personal data (Subject Access Request responded to within 1 month)
• Rectification of inaccurate or incomplete data
• Erasure ("right to be forgotten") where applicable
• Restriction of processing in certain circumstances
• Data portability where processing is automated and based on consent or contract
• Object to processing based on legitimate interests or for direct marketing
• Not be subject to automated decisions that have legal or significant effects

To exercise any right, contact us at [email protected]. We will acknowledge your request within 72 hours and respond within 30 days.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113.

5. International Data Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including:

• UK adequacy decisions for transfers to countries deemed adequate
• UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses
• Binding Corporate Rules where applicable

We document all international transfers and conduct transfer impact assessments where required.

6. Data Breach Procedure

We have a documented data breach response procedure. In the event of a personal data breach:

• We will assess the breach within 24 hours of discovery
• We will notify the ICO within 72 hours if the breach poses a risk to individuals' rights and freedoms
• We will notify affected individuals without undue delay if the breach poses a high risk to them
• We will document all breaches, even those not requiring notification

7. Data Processing Agreements

Where ATTFT processes personal data on behalf of clients (acting as a data processor), we enter into a written Data Processing Agreement (DPA) that meets the requirements of Article 28 UK GDPR, covering:

• The subject matter and duration of processing
• The nature and purpose of processing
• The type of personal data and categories of data subjects
• ATTFT's obligations and rights as processor
• Sub-processor requirements
• Security measures and breach notification obligations

Contact us to request a DPA for your engagement: [email protected].

8. ICO Registration

ATTFT Limited is registered with the Information Commissioner's Office (ICO) as required for organisations that process personal data. Our registration details are available on the ICO's public register.

For any data protection matters, contact us at [email protected].