← Back to Trust CentreData Protection Overview

Respecting privacy.
Protecting your data.

Privacy is part of how we design, deliver and manage DPS Compliance Hub. Our approach combines clear responsibilities, secure processing and practical accountability under UK and EU data protection requirements.

Illustrative workplace photograph for Privacy & GDPR
Our privacy commitments
Customer workspace data

UK hosting

Your primary workspace data is hosted in Microsoft Azure in the United Kingdom.

Clear responsibilities

Agreed processing

Formal client agreements define our processor responsibilities and your instructions.

Professional oversight

Appointed DPO

Data protection oversight supports our governance, assessments and response to individual rights.

Purposeful, proportionate processing

Data protection
by design.

We protect personal data and use it for the purpose for which it was collected. We limit collection to what is needed, maintain accuracy, manage retention and apply appropriate security. Lawfulness, fairness, transparency and accountability guide our processing.

We identify and document a lawful basis where DPS acts as a controller. Where we act as a processor, we follow the client’s documented instructions and support the client in meeting its controller obligations.

This overview describes the privacy principles and governance that guide DPS Compliance Hub across ISMS Workspace, PIMS Workspace and Data Privacy Workspace. Each service’s agreement sets out its processing scope and responsibilities.

Data handling and protection

Your data.
Clear boundaries.

01

Formal client agreements

We have a formal Data Sharing Agreement in place with our clients. Its data processing provisions establish the scope and purpose of processing, confidentiality, security, subprocessor arrangements, assistance with rights and incidents, and the return or deletion of data at the end of the service.

Clients act as controllers for the personal data they place in their workspace; DPS acts as their processor. DPS acts as a controller for its own account administration, service communications and security activities.

Read workspace terms and data processing provisions ↗
02

UK hosting and international processing

Customer workspace data is hosted in the UK; any international processing by support or integrations is assessed and covered by appropriate safeguards. Microsoft identity and email services, AI integrations and authorised support can have separate processing arrangements.

We assess processing locations and any applicable international transfer requirements, including contractual safeguards where required. UK hosting does not mean that every supporting service processes information exclusively in the UK.

03

Secure processing and controlled access

The current ISMS service uses AES-256 encryption for the managed database and its backups, and TLS 1.2 or later for browser and database connections. Access is restricted by authenticated identity, client membership and workspace role, with multi-factor authentication for production sign-in.

Confidentiality, authorised access and appropriate security measures form part of our processing arrangements.

Read the Security Overview ↗
04

Minimisation, retention and purpose

We process the minimum personal data needed to deliver and protect the service. We manage retention in line with documented purposes, contractual instructions and applicable obligations, and provide for deletion or return of customer data under the agreed service terms.

Governance and accountability

Professional oversight.
Documented decisions.

05

Data Protection Officer

We have an appointed Data Protection Officer (DPO) who provides independent advice and oversight on our data protection arrangements, privacy risks and the handling of individual rights.

06

Data Privacy Risk Assessments

We carry out Data Privacy Risk Assessments to identify risks and select proportionate safeguards. Where processing is likely to result in a high risk to individuals, we undertake a Data Protection Impact Assessment (DPIA) and address the findings before proceeding.

07

Records of processing

We maintain records of our processing activities as both a data controller and a data processor. These document purposes, data categories, responsibilities, recipients, retention and relevant security and transfer arrangements.

08

Policies, procedures and regulatory accountability

Our documented policies and procedures cover the requirements of UK and EU data protection legislation, including lawful processing, retention, security, rights and incident handling.

Data Privacy and Data Security Services Limited, trading as Data Privacy Services, is registered in Cyprus under company number HE 432380. We are subject to EU GDPR and have notified the Cypriot Commissioner for Personal Data Protection of our DPO appointment. This notification is a governance obligation, rather than regulatory certification of the workspaces.

Responsible artificial intelligence

Useful assistance.
Human accountability.

We govern our use of artificial intelligence in line with data protection best practice and applicable EU AI Act requirements.

Privacy remains part of the process

Our approach includes assessing providers and processing arrangements, minimising personal data supplied to AI services, controlling access and explaining relevant use. AI assistance supports professional judgement; people remain responsible for reviewing outputs and decisions.

Any AI processing is considered within the service’s documented purposes, client instructions and applicable safeguards. Integration-specific arrangements should be reviewed alongside the relevant service terms.

Response and individual rights

Support when it matters.

09

Incident management and response

We provide a documented incident management and response service designed to meet applicable data protection obligations. We assess, contain and investigate incidents, preserve relevant records and coordinate remedial action.

As a processor, we notify the affected controller without undue delay after becoming aware of a personal data breach. Where DPS acts as a controller, we assess whether regulator notification is required within 72 hours and whether affected individuals must be informed. Technical support response times do not replace these legal obligations.

10

Respecting data subject rights

We uphold individuals’ rights to information, access, rectification, erasure, restriction, portability and objection, together with protections relating to relevant automated decision-making, subject to applicable legal conditions.

We use proportionate identity checks and respond within the applicable statutory timescales. For personal data held on a client’s behalf, we assist the controller and route requests to the appropriate organisation.

Have a privacy question or want to exercise your rights?

Contact info@dataprivacyservices.co.uk. We will direct your enquiry to the appropriate privacy contact or DPO. Please avoid including unnecessary sensitive information in your initial message.

Further information

Understand your service.

This overview explains our approach. The applicable workspace terms, data processing agreement and privacy notices set out the detailed scope and responsibilities for your subscription.

Website Privacy Policy ↗ · DSAR Policy ↗ · Data Handling Complaints Process ↗ · Workspace terms and agreements ↗ · Security Overview ↗ · ICO data protection guidance ↗ · European Commission AI Act information ↗

Privacy assurance

Let’s discuss your requirements.

Ask about our processing arrangements, safeguards and workspace agreements.

Discuss data protection