Data Protection (GDPR) Policy
Last updated: 6 November 2026
This policy sets out how GoPro Consultants Ltd, trading as GoPro IT Consultants, complies with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. It applies to directors, staff, contractors and engineers who handle personal data for us. To learn how we use your own data, read our Privacy Policy.
Our registration
We are registered with the UK regulator, the Information Commission (known as the ICO), under reference ZC192395. Our directors are responsible for this policy and for keeping the registration current.
The principles we follow
- Lawful, fair and transparent: we have a lawful basis for each use of personal data and tell people what we do with it.
- Purpose limitation: we collect data for clear purposes and don’t use it in ways people wouldn’t expect.
- Data minimisation: we collect only what we need.
- Accuracy: we keep data accurate and correct it when it’s wrong.
- Storage limitation: we keep data only as long as we need it.
- Security: we protect data against unauthorised access, loss and damage.
- Accountability: we can show how we comply.
Controller and processor roles
We are the controller for our own records, such as enquiries, applications, invoices and supplier details. When we handle data only on a client’s instructions, we act as a processor: we follow those instructions, keep the data confidential, and help the client meet its own obligations. Each engagement should make clear which role applies.
Lawful bases and sensitive data
Before using personal data for a new purpose, we identify and record the lawful basis. We use special category data, such as health information, and criminal offence data only where a further condition in the law applies, and we keep it to a minimum.
Individuals’ rights
Anyone handling personal data must pass a rights request or complaint to the data protection contact straight away. Requests can arrive in any form, including by phone or social media. We follow the timescales in Your Data Rights and Complaints.
Suppliers and sharing
We use processors only where they provide sufficient guarantees, and under a written contract covering the terms the UK GDPR requires. We share personal data with clients, engineers and other third parties only for a clear purpose and with a lawful basis.
International transfers
Before sending personal data outside the UK, we check that adequacy regulations apply, put an appropriate safeguard in place such as the ICO’s International Data Transfer Agreement or UK Addendum, or confirm that a legal exception applies.
Security
We maintain an information security management system certified to ISO/IEC 27001:2022 (certificate 512872026, Citation ISO Certification Limited). Access to personal data is limited to people who need it for their role.
Personal data breaches
Anyone who suspects a personal data breach must report it to the data protection contact immediately. We assess each breach and record it, whether or not it has to be reported. If a breach is likely to put people’s rights and freedoms at risk, we notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk to people is high, we also tell them without undue delay.
Privacy by design and risk assessments
We build data protection into new services, forms and tools. We carry out a data protection impact assessment before any processing likely to result in a high risk to individuals.
Marketing and cookies
Electronic marketing and website cookies follow the Privacy and Electronic Communications Regulations. We honour marketing opt-outs promptly. The technologies on our website are listed in the Cookie Policy.
Records and training
We keep a record of our processing activities, along with records of breaches, rights requests and complaints. People who handle personal data are told what this policy requires, and are given guidance suited to their role.
Review
We review this policy at least once a year, and sooner if the law or our work changes.
