GDPR

Why this matters

Much of our work involves handling records that contain personal data — staff files, tenancy paperwork, customer invoices, training and certification records. When we do that on a client's instruction, the client is the data controller and Servio acts as a data processor under Article 28 of the UK GDPR.

Our commitments as processor

Every engagement that involves personal data is covered by a written data processing agreement forming part of the scope of work. Under it we commit to the following.

• Process personal data only on your documented instructions
• Keep the data confidential and restrict access to the named team on your account
• Apply appropriate technical and organisational security measures
• Not appoint a sub-processor without telling you first
• Assist you with data subject requests, impact assessments and regulator queries
• Notify you without undue delay if we become aware of a personal data breach
• Return or securely delete the data when the engagement ends

Sub-processors

We use established business software providers for email, document storage and accounting. We keep a current list of these providers and will send it to any client on request. We will always give notice before adding or replacing one.

International transfers

Some of our team work remotely from outside the United Kingdom. Where this results in personal data being accessed from another country, we rely on the UK International Data Transfer Addendum or an adequacy decision, and we tell you which countries are involved before the engagement starts.

Remote team members sign the same confidentiality and data protection undertakings as our office staff and work inside your systems rather than holding copies of your records.

Security measures

Devices are encrypted with password management and two-factor authentication where available. Access is granted per account, reviewed quarterly and revoked the day a team member leaves or an engagement ends. We do not store client records on personal devices or removable media.

Data subject requests

If an individual contacts us directly about data we hold on your behalf, we will not respond on your behalf. We will forward the request to your named contact within two working days and help you answer it within the statutory one-month deadline.

Breach response

If we identify a personal data breach affecting your records, we will notify your named contact without undue delay and in any case within 24 hours, with what we know, what we have done and what we recommend. You remain responsible for deciding whether to notify the ICO and affected individuals.

Records and audit

We keep records of the processing we carry out for each client. Clients may request a written summary of our processing activities, security measures and sub-processors once per year at no charge.

Contact

Data protection queries should go to hello@serviosupport.com, marked for the attention of the director. You can complain to the Information Commissioner's Office at ico.org.uk at any time.