GDPR Compliance

Last updated: January 2024

Our Commitment to Data Protection

sequoia-soar is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have implemented policies, procedures and training to ensure compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

sequoia-soar is the data controller for personal information collected through our website and advisory services. This means we are responsible for deciding how we hold and use personal information about you.

Contact details:
sequoia-soar
47 Wellington Street
Leeds, LS1 4JR
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contractual necessity: Processing necessary for the performance of our advisory services
• Legal obligation: Processing necessary for compliance with legal requirements
• Legitimate interests: Processing necessary for our legitimate business interests, provided these are not overridden by your interests or rights
• Consent: Where you have given clear consent for us to process your personal data for specific purposes

Special Category Data

In providing our services, particularly relating to disability benefits, we may process special category data including health information. We process this data under the following conditions:

• Explicit consent provided by you
• Processing necessary for reasons of substantial public interest
• Processing necessary for the establishment, exercise or defence of legal claims

Your Data Protection Rights

Under UK GDPR, you have the following rights:

Right of Access

You have the right to request copies of your personal data. We may charge a small fee for this service in certain circumstances.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data, under certain conditions. This right is not absolute and may be limited by our legal obligations to retain certain records.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data, under certain conditions.

Right to Object to Processing

You have the right to object to our processing of your personal data, under certain conditions.

Right to Data Portability

You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.

Exercising Your Rights

If you wish to exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month of receiving it. In certain circumstances, this period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Data Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Secure storage of physical documents
• Access controls limiting who can access personal data
• Regular testing and evaluation of security measures
• Staff training on data protection requirements

Data Breaches

In the event of a personal data breach, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, where the breach is likely to result in a risk to individuals' rights and freedoms. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Website: ico.org.uk