Data Protection & Privacy Policy

This is our internal data protection policy. It also covers our work as a processor for clients. For how we handle personal data collected through our website, see our website privacy notice.

1. Commitment and law

Riviera Designs Ltd protects personal data in line with:

• the UK General Data Protection Regulation

• the Data Protection Act 2018

• the Privacy and Electronic Communications Regulations (PECR)

2. Registration

We are registered with the Information Commissioner's Office, registration number ZC250447.

3. Our roles

• We are a controller for our own business data (clients, enquiries, suppliers, staff).

• When we build or host websites for clients, we are usually a processor, acting only on the client's written instructions.

4. Principles

We process personal data lawfully, fairly and transparently. We use it only for stated purposes, collect only what we need, keep it accurate, keep it only as long as needed, and keep it secure.

5. Security

We use appropriate technical and organisational measures, including:

• strong passwords and multi-factor authentication on business accounts

• encrypted devices and connections (HTTPS/TLS)

• least-privilege access

• regular software updates

• backups

• secure deletion when work ends

6. Location

We keep client personal data in the UK or the European Economic Area. Any other transfer uses safeguards that UK law recognises: UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum. Before work starts, we list each sub-processor and its location for the client.

7. Subcontractors

We only use sub-processors with the client's prior written consent. They are bound by written terms giving the same protection as ours.

8. Breaches

We report any personal data breach affecting client data to the client without undue delay, and in any case within 24 hours of becoming aware of it. We help the client meet its own obligations, including notifying the ICO within 72 hours where needed.

9. Individuals' rights

We respond to requests (access, rectification, erasure and so on) within one month. When we are a processor, we pass requests to the client straight away and help them respond.

10. Websites we build

We build privacy in by design:

• cookie consent that meets PECR (no non-essential cookies before consent)

• minimal data collection in forms

• a clear privacy notice

• extra care for children's content (no tracking or profiling of children)

11. Training and responsibility

Everyone who handles personal data for us is briefed on this policy and bound by confidentiality. The Director is responsible for data protection. Contact: admin@rivieradesigns.co.uk.

12. Review

Reviewed every year and whenever the law changes.

Questions about this policy? Email admin@rivieradesigns.co.uk.