Scope
This statement relates to the EUAIC website and business enquiries. Customer platform data, support data and service records should be governed by the relevant contract, privacy terms, data processing addendum and technical configuration.
Data protection principles
Personal data should be processed lawfully, fairly and transparently. It should be collected for clear purposes, limited to what is necessary, kept accurate where practical, retained only as needed and protected with appropriate security.
Typical lawful bases
Business enquiry handling may rely on legitimate interests, contractual steps, contract performance, legal obligations or consent depending on the communication and processing activity.
Rights handling
Individuals may have rights to access, rectification, erasure, restriction, objection, portability and withdrawal of consent where consent is relied upon. Requests should be assessed based on identity, scope, legal basis and any retention obligations.
Supervisory authority
Individuals can raise concerns with the UK Information Commissioner’s Office if they believe data protection rights have been infringed. Organisations should first be given a fair opportunity to review and respond where appropriate.
Website records and service records
Website enquiry records are different from customer platform records. Enquiries normally relate to business contact and sales communication. Customer platform records may involve configured service data, user accounts, support tickets, logs, documents or evidence files and should be covered by service-specific terms.
Data minimisation
Only information reasonably needed for the purpose should be requested or retained. If a visitor sends unnecessary personal data, the information may still be received, but it should not be used beyond appropriate handling, response, deletion, security review or lawful record keeping.
Accountability
A GDPR-aware approach requires more than a policy page. It depends on accurate records, access control, supplier review, retention discipline, staff awareness, appropriate contracts and a process for handling rights requests and incidents.