Data Protection Policy.

Purpose, scope and responsibility

WESTEVO is committed to handling personal information lawfully, fairly, transparently and securely. This policy applies to customer, prospect, supplier, business-contact, website-visitor and other personal information handled for WESTEVO, whether digital, photographic, verbal or on paper.

Address: Joiners Meadow, Trevillick, Tintagel, Cornwall, PL34 0DN
Email: hello@westevo.co.uk

The standards WESTEVO follows

Controls through the data lifecycle

Before collecting information

• Define the purpose, lawful basis, necessary fields, recipients and retention period.
• Use privacy by design: collect the least information needed and choose the least intrusive workable method.
• Assess higher-risk or materially new processing before it begins and complete a data-protection impact assessment where legally required.
• Make the relevant Privacy Notice available at or before collection.

While using information

• Restrict use to authorised business purposes and access to people who need it.
• Check accuracy where a decision, quotation, safety measure or communication depends on it.
• Record consent where consent is relied on and make withdrawal as easy as giving it.
• Do not reuse quotation enquiries for marketing without a separate lawful route under data-protection and electronic-marketing rules.

When the purpose ends

• Apply the retention schedule across email, Google Workspace, Squarespace, downloaded files, photographs and paper records.
• Delete duplicate copies where they are no longer required.
• Use secure deletion or destruction appropriate to the sensitivity and format of the record.

Lawful use, photographs and marketing

WESTEVO's usual lawful bases are:

• Contract or steps requested before a contract for enquiries, quotations, bookings and service delivery.
• Legal obligation for tax, accounting, regulatory, rights and other statutory requirements.
• Legitimate interests for proportionate business administration, security, service improvement, safety, fraud prevention and legal claims, after considering people's rights.
• Consent where a freely given, specific and recorded choice is appropriate, including selected marketing or identifiable promotional imagery.

WESTEVO will not make an unsupported privacy, security, environmental or accreditation claim. Direct marketing will comply with applicable data-protection and electronic-communications rules, and every marketing message will provide a straightforward way to opt out.

Security and access controls

• Use unique authorised accounts and multi-factor authentication wherever available, especially for administrator access.
• Give each person only the access needed for their role and review privileged access when responsibilities change.
• Keep supported devices, browsers and security software updated; use screen locks and protect devices from loss or unauthorised use.
• Use Google Workspace for WESTEVO business email and documents rather than uncontrolled personal storage.
• Use secure connections and reputable providers; avoid sending unnecessary sensitive information by ordinary email.
• Protect paper records and portable devices from casual access, and securely destroy records when retention ends.
• Verify unusual payment, account-change or disclosure requests through a trusted channel before acting.
• Keep recovery information and backup arrangements protected from the same incident that could affect the main account.

Security controls are reviewed proportionately as WESTEVO's services, staffing, systems and risk profile develop. Public policy wording does not replace the confidential operational details needed to implement those controls.

Suppliers, processors and transfers

A provider that processes personal information for WESTEVO is selected only after proportionate checks covering purpose, security, confidentiality, deletion, sub-processors, breach support and international transfers. Required data-processing terms must be in place before processing begins.

Core website and communication processors currently include:

• Squarespace for website hosting and forms, subject to its Data Processing Addendum.
• Google Workspace and Google Drive for business email, files and form-response storage.

If a provider processes data outside the UK, WESTEVO will rely on a recognised transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and will keep the arrangement under review.

Retention and secure disposal

Harlan West reviews the schedule at least annually. A hold is applied where deletion could prejudice an open complaint, legal claim, insurance matter, tax enquiry, regulator request or rights request. The reason and review date must be recorded.

Individual rights and complaints

Any request about access, correction, erasure, restriction, portability, objection or consent withdrawal is treated as a data-rights request even if the person does not use legal terminology.

1. Record the date received, scope and contact method.
2. Confirm identity only to the extent reasonably necessary and avoid requesting excessive identification.
3. Search all relevant systems, including email, Squarespace, Google Workspace, photographs and paper records.
4. Protect other people's information and document any exemption or refusal.
5. Respond without undue delay and normally within one calendar month; record any legally permitted extension and tell the requester within the first month.

A data-protection complaint can be made by emailing hello@westevo.co.uk. WESTEVO will acknowledge it within 30 days, investigate without undue delay, keep the complainant appropriately informed and communicate the outcome. Details of rights, complaints and the ICO are in the Privacy Notice.

Personal-data breach response

A suspected loss, unauthorised disclosure, alteration, access, destruction or loss of availability must be reported immediately to Harlan West. WESTEVO will:

1. contain the incident, preserve relevant evidence and recover information where safely possible;
2. record what happened, when it was discovered, the information and people involved, likely consequences and action taken;
3. assess the risk to people's rights and freedoms without delay;
4. notify the ICO without undue delay and, where feasible, within 72 hours of awareness if the legal reporting threshold is met;
5. notify affected people without undue delay if the breach is likely to create a high risk to them; and
6. document lessons, corrective action and whether supplier or control changes are required.

Every personal-data breach is logged, including incidents that do not meet the ICO reporting threshold. The ICO's current guidance is available on its 72-hour breach-response page.

Training, records and review

• Anyone given access to personal information must understand this policy, confidentiality expectations, phishing risks, rights requests and incident reporting.
• WESTEVO keeps proportionate records of processing purposes, lawful bases, retention, processors, important decisions, complaints, requests and breaches.
• The ICO data-protection fee position is checked when processing changes and at least annually; any fee required by law must be maintained.
• The website form, cookie settings, access permissions and supplier terms are reviewed after material changes and at least annually.
• This policy is reviewed by Harlan West by 31 August 2027, or earlier following a material legal, service, system, supplier or incident change.

Non-compliance must be corrected promptly. Serious or repeated issues may lead to access removal, supplier review, retraining, contract action or reporting to the appropriate authority where required.