Data Protection Policy

Indigital XYZ Limited, trading as Favoured · Company number 10869455 · ICO registration ZB049050

Why this document exists. It is referenced by the Data Protection Compliance Statement issued to buyers in public procurement, which describes “our data protection policy and the procedures beneath it”. Anything asserted in that statement must be true here, and vice versa. If the two disagree, that is a defect to fix, not a difference of emphasis.

1. Scope and roles

This policy applies to every member of staff, contractor and sub-processor who handles personal data on behalf of Favoured.

Data Protection Lead: Andrew Willers. The role carries accountability for this policy, the record of processing activities, retention and deletion, breach identification and reporting, the appointment and review of sub-processors, and responses to data subject rights requests.

We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR: we are not a public authority, our core activities do not consist of large-scale systematic monitoring, and we do not process special category data at scale. We have designated the role regardless so that accountability sits with a named individual.

Controller and processor. For our own business data (staff, prospects, suppliers) we are the controller. For client campaign data we are almost always the processor, acting on the client’s documented instructions under a data processing agreement.

2. Lawful basis and consent

Every processing activity is recorded against a lawful basis in the record of processing activities before it begins.

Where processing relies on consent, the consent must be active, informed and specific, and the record must show what the person was told and when they agreed. We do not treat pre-ticked boxes, silence or inactivity as consent, and we do not rely on consent obtained for one purpose to justify another.

Where a client supplies a marketing list for use in a campaign, we require written confirmation of the lawful basis for that list before it is used. This is a hard gate, not a formality: it is the single most likely route by which we would process personal data unlawfully.

For our own business development we rely on legitimate interests for B2B contact data, with a legitimate interests assessment recorded, and we honour objections and opt-outs immediately.

3. Record of processing activities

We maintain a record under Article 30 covering categories of data subject and personal data, purposes, recipients including sub-processors, transfers outside the UK, and retention periods. It lives at ROPA.md beside this policy and is reviewed at least annually and whenever a new tool or sub-processor is introduced.

4. Retention and deletion

Personal data is kept only for as long as the purpose requires. The schedule is at RETENTION_SCHEDULE.md.

Client-supplied audience data is held for the campaign period and then deleted or returned on request, and in any event at the end of the engagement. Deletion covers copies held in advertising platforms as well as our own storage — a custom audience left live in an ad account is retained data, and is the failure mode most likely to catch us out.

5. Security of processing

The technical and organisational measures are set out in full in the Data Protection Compliance Statement and are summarised here:

• Encryption. Personal data encrypted in transit using TLS and at rest by the cloud platforms we

operate on. Client data transferred by secure means rather than as an email attachment, and identifiers hashed before upload wherever the receiving platform supports it.

• Access control. Least privilege, only to people working on the account. Multi-factor

authentication required for email, cloud storage and advertising platforms. Access reviewed on role change and revoked on the day someone leaves.

• Devices. Vendor-supported operating systems, automatic security updates, screen lock, and the

platform malware protection and code-signing controls active.

• Resilience. Managed cloud services with provider-level redundancy and backup.
• Review. Security arrangements and the ROPA reviewed at least annually and after any incident or

material change of tooling.

Known gaps, recorded honestly rather than omitted (see ../cyber-essentials/GAP_ANALYSIS.md): full-disk encryption is being enabled across the fleet; multi-factor authentication is enrolled on 23 of 25 accounts with the remaining two in progress; the host firewall needs enabling fleet-wide; and administrative accounts are not yet separated from day-to-day accounts. We do not hold a Cyber Essentials certificate and are pursuing one.

6. Personal data breaches

Any suspected breach is reported immediately to the Data Protection Lead, who assesses risk to the rights and freedoms of data subjects.

• Where the threshold is met we notify the **ICO without undue delay and in any event within 72

hours** of becoming aware, and notify affected data subjects where the risk is high.

• Where we act as processor we notify the client controller without undue delay so they can meet

their own obligations. We notify on becoming aware; we do not wait for our own assessment to conclude.

• Every breach, including those not meeting the notification threshold, is logged with the facts,

the effects and the remedial action taken.

7. Sub-processors

No sub-processor is appointed without the controller’s prior written authorisation. Before appointment we check that the provider offers terms giving at least the same protection as our own obligations, including a lawful transfer mechanism where it processes outside the UK. The sub-processor list is recorded in the ROPA and shared with clients, and we give advance notice of any intended change so a client can object.

8. International transfers

Our operations and our team are UK based. Several advertising, analytics and productivity platforms are United States companies processing outside the EEA. For restricted transfers we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which those providers incorporate into their standard terms, and on adequacy regulations where the recipient is covered. We do not operate Binding Corporate Rules, being a single company rather than a group. A transfer risk assessment is carried out where one is required.

9. Data subject rights

We support the rights to be informed, of access, to rectification, to erasure, to restriction, to portability and to object. Requests are acknowledged and actioned within one month. Where we act as processor we pass any request we receive to the controller promptly and assist them in responding within the statutory period.

10. Training

Every member of staff who handles personal data completes data protection training on joining, before being given access to client data, and annually thereafter. The current annual cycle commenced in September 2026. Training covers lawful bases, consent standards, recognising and reporting a suspected breach, handling data subject requests, and the rules specific to marketing data and audience lists. Completion is recorded against each individual.

11. Breaches of this policy

Failure to follow this policy may be treated as a disciplinary matter. Anyone who believes the policy has been breached must tell the Data Protection Lead immediately. Reporting a suspected breach in good faith will never itself be treated as a disciplinary matter — the reverse is what causes real harm, because an unreported breach cannot be contained inside 72 hours.