Data Protection and Information Handling Policy

Sensory Visionaries Limited | Company No. 10803260 | ICO ZC255618
Registered office: 6 Newbury Walk, Romford, England, RM3 8HD
Contact: contact@sensoryvisionaries.com | www.sensoryvisionaries.com

Last reviewed: 3 October 2026

1. Purpose

This policy summarises the standards Sensory Visionaries applies when handling personal and confidential information. The Privacy Notice explains the information provided to individuals.

2. Core principles

 Use personal information lawfully, fairly and transparently.  Collect only information reasonably needed for a defined purpose.  Keep information accurate where necessary.  Retain information no longer than needed.  Protect confidentiality, integrity and availability with proportionate security.  Be able to demonstrate compliance.

3. Special category information

Health and disability information receives additional protection. Before processing it, we identify an Article 6 lawful basis and an applicable Article 9 condition and document any additional requirements.

4. Access and sharing

Access is limited to people who need the information for an authorised purpose. Information is not shared merely because another person asks for it. Identity, authority, necessity and lawful basis are considered before disclosure.

5. Suppliers

Suppliers that process personal information for us should be subject to appropriate contractual, security and data protection controls. Processor arrangements should contain the terms required by applicable data protection law.

6. Breaches

Suspected personal data breaches should be assessed promptly, contained where possible, documented and escalated. Where legal thresholds are met, notification to the ICO and affected individuals will be considered within the required timescales.

7. Retention and deletion

A separate retention schedule should define how long different records are kept and how they are securely deleted or anonymised when no longer required.

8. Information lifecycle

We consider information throughout its lifecycle: collection, use, access, storage, sharing, retention and secure deletion. We aim to collect only information that is relevant to the purpose, keep it accurate where necessary and avoid retaining identifiable information indefinitely without a reason.

9. Special category and safeguarding information

Information about health, disability and some other matters may be special category data under UK data protection law. Where we process special category data, we must identify both an Article 6 lawful basis and an appropriate Article 9 condition. Safeguarding information may require particularly careful access controls, factual recording and decisions about lawful sharing.

10. Access control and security

Access to personal information should be limited to people who need it for an authorised purpose. We use proportionate technical and organisational measures and expect service providers handling personal data for us to provide appropriate safeguards. No online system can be described as absolutely secure, so security measures are reviewed according to risk.

11. Data breaches

Suspected loss, unauthorised disclosure, alteration or access to personal data should be assessed promptly. We will document and respond to personal data breaches in accordance with applicable UK GDPR requirements, including notification to the Information Commissioner’s Office and affected individuals where the relevant legal thresholds are met.

12. Suppliers, processors and international transfers

Where another organisation processes personal data on our behalf, we will consider the need for an appropriate data processing agreement and security assurances. If personal data is transferred internationally, we will consider whether the destination is covered by UK adequacy arrangements or whether another lawful transfer safeguard is required.

13. Individual rights and accountability

Requests relating to data protection rights will be handled in accordance with applicable law. We maintain appropriate records to demonstrate our decisions and will review data protection arrangements when services, systems or suppliers materially change.

14. Legal framework

This policy is intended to support compliance with the UK GDPR, Data Protection Act 2018 and, where relevant to electronic communications and cookies, PECR. Detailed operational schedules and security procedures may be maintained internally rather than published where publication would be unnecessary or create security risk.