Data
protection.
How we look after personal data inside the business. For what we collect from customers and why, see our privacy notice.
Version 3 · October 2026 · next review October 2027
1. Purpose
Silverstone Cerakote Ltd is committed to protecting the personal data of its customers, employees, suppliers and everyone else we deal with. This policy sets out how we meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. What we collect from customers, and why, is explained in our privacy notice.
2. Scope
This policy covers all personal data we process, about employees, customers, suppliers, contractors and others, and everyone who handles it for us: employees, contractors and the suppliers who process data on our behalf.
3. Key terms
- Personal data: any information about an identified or identifiable person, such as a name, address, email address or identification number.
- Processing: anything done with personal data, including collecting, recording, storing, using, sharing and deleting it.
- Data subject: the person the data is about.
- Controller: the organisation that decides why and how personal data is processed. For the data in this policy, that is Silverstone Cerakote Ltd.
- Processor: an organisation that processes personal data on the controller's behalf.
4. Our principles
We make sure personal data is:
- processed lawfully, fairly and transparently
- collected for specified, legitimate purposes and not used in ways that conflict with them
- adequate, relevant and limited to what we need
- accurate and kept up to date
- kept no longer than necessary
- kept secure against unauthorised use, loss or damage
5. Responsibility
We are not required to appoint a statutory Data Protection Officer. Our Managing Director is responsible for data protection: making sure this policy is followed, being the contact point for individuals and the Information Commissioner's Office (ICO), keeping our records of processing up to date, and arranging training. Contact: contact@silverstonecerakote.co.uk.
6. Individuals' rights
People can ask us to give them a copy of their data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent. Requests go to contact@silverstonecerakote.co.uk. We confirm who is asking before releasing any data, and reply within one month.
7. Data breaches
Anyone who suspects a breach must report it to the Managing Director straight away. If a breach is likely to put people's rights and freedoms at risk, we report it to the ICO within 72 hours of becoming aware of it, and tell the people affected without undue delay if the risk is high. We record every breach, whether or not it has to be reported.
8. Security
- Every member of staff has their own login. Access is limited to what each role needs.
- Customer files are stored privately and are never published.
- Our website and systems use encrypted connections, and each customer account can only see its own data.
- Devices are password-protected, and paper records with personal data are kept secure and shredded when no longer needed.
9. Suppliers who process data for us
We only use suppliers who give sufficient guarantees that they protect personal data, under written contracts that include the terms UK GDPR requires. The main ones are listed in our privacy notice.
10. Transfers outside the UK
Where personal data is transferred outside the UK, we rely on UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.
11. Data protection by design
We consider data protection at the start of any new system or process that uses personal data, collect only what we need, and carry out a data protection impact assessment where processing is likely to be high risk.
12. Retention and disposal
We keep personal data only as long as we need it, following the periods in our privacy notice, and then delete or destroy it securely.
13. Marketing
We only send marketing emails to people who have agreed to receive them, and every email includes a way to opt out.
14. Employees
We process employee data for employment purposes only, keep it secure, and handle it in line with this policy and employment law.
15. Training and review
Staff who handle personal data receive data protection training. We review this policy every year, or sooner if the law or our business changes. Failure to follow it may lead to disciplinary action.