Data and Privacy Policy
1. About this document
1.1 Introduction
Previsico is committed to protecting the privacy and security of personal data. In the course of their work,
employees may collect, use, transfer or store personal information about employees, clients, customers and
suppliers, such as names, contact details and other identifying information. The UK’s data protection legislation,
including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, imposes strict principles
and legal conditions that must be met before and during any processing of personal information.
1.2 Purpose
The purpose of this policy is to ensure that all employees understand their responsibilities in relation to data
protection legislation and handle personal data in a lawful, fair and transparent way. Previsico takes its obligations
seriously and expects the same commitment from everyone who works for us. A breach of data protection
legislation can cause significant distress to the individuals affected and expose the Company to financial penalties
and reputational damage.
If you are ever unsure about what you can or cannot disclose, and to whom, please seek advice from Previsico’s Data
Protection Officer, Craig Deacon, at craig.deacon@previsico.com before sharing any personal information.
1.3 Scope
This policy applies to all employees, workers and contractors and does not form part of any contract of employment.
Attendance at related training is mandatory. All employees are required to read, understand and comply with this
policy. It should be read alongside the IT Security Statement and Identity and Access Management Statement, which
set out the technical and operational controls Previsico uses to keep personal data secure.
2. Definitions
For the purposes of this policy, the key terms are defined as follows. A Data Subject is a living individual. A Data
Controller is the person or organisation that determines the means and purpose of processing personal data. Data
Protection Legislation includes the Data Protection Act 2018, the General Data Protection Regulation and any related
national implementing laws, regulations and secondary legislation. Personal Data is information that identifies a
living individual either directly or indirectly, including special categories of personal data. Processing covers any
activity relating to personal data, including collecting, recording, storing, amending, disclosing, transferring,
retrieving, using or destruction. Special Categories of Personal Data includes data revealing ethnic origin, political
opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, sex life and sexual
orientation. Criminal Records Data covers information about an individual’s criminal convictions and offences.
3. Roles and Responsibilities
3.1 Data Protection Officer
Previsico’s Data Protection Officer (DPO) is Craig Deacon. The DPO is responsible for overseeing compliance with
data protection legislation, providing guidance on data protection matters, managing data breach notifications,
maintaining records of processing activities and acting as the primary point of contact with the Information
Commissioner’s Office (ICO). Employees should contact the DPO with any data protection queries or concerns.
3.2 Managers
Managers are responsible for ensuring their teams understand and comply with this policy, for identifying any data
handling practices that may require review, and for escalating data protection concerns to the DPO promptly.
3.3 All Employees
All employees who handle personal data as part of their role are responsible for doing so in accordance with this
policy and the data protection principles set out in section 4. Employees must complete all required data protection
training and report any suspected breaches immediately.
4. GDPR Principles
As a data controller, Previsico is required to ensure that personal data is processed in accordance with the following
principles. Personal data must be processed lawfully, fairly and transparently. It must be collected for specified,
explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Data
collected must be adequate, relevant and limited to what is necessary. It must be accurate and, where necessary,
kept up to date. It must be kept in a form that permits identification of individuals for no longer than is necessary. It
must be processed in a manner that ensures appropriate security, including protection against unauthorised or
unlawful processing and against accidental loss, destruction or damage.
All employees must apply these principles in their day-to-day information handling. If you become aware that any
principle has been breached or is likely to be breached, you must inform the DPO immediately.
5. Lawful Processing of Personal Data
Personal data may only be processed where there is a lawful basis for doing so. This will typically include: consent
from the data subject for a specific purpose, a contractual necessity where processing is required to perform a
contract, a legal obligation where processing is required by law, or a legitimate interest pursued by Previsico or a
third party, provided that this interest is not overridden by the data subject’s rights and interests. Processing may
also be necessary to protect the data subject’s vital interests or to perform a task carried out in the public interest.
6. Privacy Notices
Before collecting or processing personal data directly from a data subject, employees must ensure an appropriate
privacy notice has been issued. This notice must provide clear, accurate and transparent details of the lawful and fair
reasons for processing, explain how, when and for how long the data will be processed, and outline the data
subject’s rights and how their information will be kept secure. Where data is collected indirectly, a privacy notice
must be issued to the data subject within a reasonable period and no later than one month from the date of
collection.
7. Data Security
Previsico is committed to maintaining appropriate technical and organisational measures to protect personal data.
Employees are responsible for following these measures, which include using secure methods for transmitting
personal data such as encrypted email, keeping personal data securely whether in locked storage or passwordprotected digital formats, and avoiding unauthorised access or processing of data beyond their authorised scope.
Further detail on the technical controls in place is set out in the IT Security Statement and Identity and Access
Management Statement.
7.1 Data Breach Procedure
A data breach involves the loss, destruction, corruption or unauthorised disclosure of personal data. In the event of a
suspected or confirmed breach, employees must immediately inform the Data Protection Officer, follow Previsico’s
incident response procedures to contain the breach and mitigate its effects, and cooperate fully with any
investigation. Where required under GDPR, the DPO will notify the ICO and any affected data subjects within the
relevant timeframes.
8. Record Keeping
Previsico maintains records of all data processing activities in accordance with its obligations under GDPR. This
includes documenting the purposes of processing, the categories of data and data subjects involved, and the
retention periods applied. Records of consents and privacy notices relied upon for processing are also maintained.
Employees should contact the DPO if they need guidance on record keeping requirements for their specific activities.
9. Training
All employees who handle personal data are required to complete data protection training and maintain a working
understanding of their obligations under this policy. Previsico will provide appropriate training, and employees must
attend all sessions required for their role. Employees with specific responsibilities relating to data security, marketing
or database management will receive additional specialist training as appropriate.
10. Automated Processing and Profiling
Where automated processing or decision making is used and has a significant effect on a data subject’s rights or
interests, that individual has the right to request human review of the decision. Employees should contact the DPO if
they are involved in or have concerns about any automated processing activities that may engage this right.
11. Sharing Personal Data
Personal data may only be shared with authorised persons and in accordance with the relevant privacy notice or
consent. Particular care must be taken when sharing special categories of data or transferring data to third parties or
outside the UK. Any proposed data sharing arrangements that have not been previously approved should be
discussed with the DPO before proceeding. Transfers of personal data to countries outside the UK or EEA must have
appropriate safeguards in place, as required by data protection legislation.
12. Direct Marketing
Data subjects have the right to object to the use of their personal data for direct marketing purposes. Where a data
subject exercises this right, all further direct marketing communications to that individual must cease immediately.
Employees involved in marketing activities must familiarise themselves with the requirements in this area and seek
guidance from the DPO where needed.
13. Concerns and Complaints
Any employee who believes this policy has been breached, or who wishes to raise a data protection concern, should
contact Craig Deacon, Data Protection Officer, at craig.deacon@previsico.com. Data subjects who wish to exercise
their rights under GDPR, including subject access requests, should also be directed to the DPO. Previsico is
committed to handling all concerns promptly and confidentially.
14. Monitoring and Review
This policy is reviewed annually by Previsico’s Senior Management Team to ensure it remains current and reflects
any changes in data protection legislation, regulatory guidance or business practice. Updates will be communicated
to all employees. Employees are expected to familiarise themselves with any changes that affect their role.
Version: 5
Authorised by: Anna Gunn, People & Culture Manager
Date: January 2026
Next Review: January 2027