Data Protection Policy.

Purpose, scope and responsibility

Westevo is committed to handling personal information lawfully, fairly, transparently and securely. This policy applies to information handled for website visitors, email enquiries, suppliers, professional contacts, business administration and future studio communications.

Harlan West T/A Westevo is the data controller and policy owner. Harlan West remains accountable for data-protection compliance where an authorised administrator, adviser, supplier or technology provider assists the business.

Email: hello@westevo.co.uk

The standards Westevo follows

Controls through the data lifecycle

Before collecting information

• Define the purpose, lawful basis, information needed, recipients and retention period.
• Collect the least information needed and choose the least intrusive workable method.
• Make the relevant Privacy Notice available at or before collection where practical.

While using information

• Restrict use to authorised business purposes and limit access to people who need it.
• Keep records organised so rights requests, corrections and removals can be handled properly.
• Record consent where consent is relied on and make withdrawal as straightforward as giving it.

When the purpose ends

• Delete, anonymise or securely destroy information when there is no continuing need to keep it.
• Remove unnecessary duplicate copies from email, cloud storage, downloads and paper records.
• Apply a hold where removal could prejudice an open rights request, complaint, legal claim, tax matter, regulator request or security incident.

Security and access controls

• Use unique authorised accounts and multi-factor authentication wherever available, especially for administrator access.
• Give each person only the access needed for their role and review privileged access when responsibilities change.
• Keep supported devices, browsers and security software updated; use screen locks and protect devices from loss or unauthorised use.
• Use reputable providers for website, email, file storage and communication systems.
• Avoid sending unnecessary sensitive information by ordinary email.
• Verify unusual payment, account-change or information-sharing requests through a trusted channel before acting.
• Protect recovery information and backup arrangements from the same incident that could affect the main account.

Security controls are reviewed proportionately as Westevo's systems, suppliers and risk profile develop. Public policy wording does not replace the confidential operational details needed to implement those controls.

Suppliers, processors and sharing

A provider that processes personal information for Westevo is selected only after proportionate checks covering purpose, security, confidentiality, deletion support, sub-processors, breach support and international transfers.

Core website and communication providers may include Squarespace for website hosting and forms, Google Workspace for business email and files, and professional advisers where needed for lawful administration.

If a provider processes information outside the UK, Westevo will rely on a recognised transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and will keep the arrangement under review.

Individual rights and complaints

Any request about access, correction, erasure, restriction, portability, objection or consent withdrawal is treated as a data-rights request even if the person does not use legal terminology.

1. Record the date received, scope and contact method.
2. Confirm identity only to the extent reasonably necessary.
3. Search relevant systems, including email, Squarespace, Google Workspace, downloads and paper records.
4. Protect other people's information and document any exemption or refusal.
5. Respond without undue delay and normally within one calendar month.

A data-protection complaint can be made by emailing hello@westevo.co.uk. Westevo will investigate without undue delay and communicate the outcome. People also have the right to complain to the Information Commissioner's Office.

Personal-data breach response

A suspected loss, unauthorised access, alteration, destruction, sharing or loss of availability must be reported immediately to Harlan West. Westevo will:

1. contain the incident, preserve relevant evidence and recover information where safely possible;
2. record what happened, when it was discovered, the information and people involved, likely consequences and action taken;
3. assess the risk to people's rights and freedoms without delay;
4. notify the ICO without undue delay and, where feasible, within 72 hours of awareness if the legal reporting threshold is met;
5. notify affected people without undue delay if the breach is likely to create a high risk to them; and
6. document lessons, corrective action and any supplier or control changes required.

Every personal-data breach is logged, including incidents that do not meet the ICO reporting threshold.

Training, records and review

• Anyone given access to personal information must understand this policy, confidentiality expectations, rights requests, phishing risks and incident reporting.
• Westevo keeps proportionate records of processing purposes, lawful bases, retention, processors, important decisions, complaints, requests and breaches.
• The website form, cookie settings, access permissions and supplier terms are reviewed after material changes and at least annually.
• This policy is reviewed by Harlan West by 29 September 2027, or earlier following a material legal, system, supplier or incident change.