Who we are and how to contact us
Approved controller identity and contact details must be added before publication.
Information we collect
The approved policy must explain enquiry, referral and recruitment contact information. Website forms must not request sensitive case information.
Purposes and lawful bases
Confirm the purpose and UK GDPR lawful basis for each use of information before publication.
Processors and international transfers
The proposed processors are Vercel (hosting and analytics), Microsoft (email), Cloudflare (spam protection) and Upstash (rate limiting and duplicate submission prevention). Confirm enabled services, processing agreements, transfer safeguards and data locations before publication.
Retention and security
Insert approved retention periods and a description of access controls and deletion arrangements.
Your rights and complaints
Explain applicable UK GDPR rights, how to make a request and the right to complain to the Information Commissioner’s Office.