Data Processing Policy

Version Explanation

Document versions are identified using the format v{major}.{minor}. Full version history of the document is available by selecting a different version above.

Major Version

The major version number will be incremented where there is a significant or substantive change to the document. This includes, but is not limited to:

• The addition or removal of a clause.
• A change to the substance or requirements of a clause resulting from an updated process, regulation, or other material change.

A new major version will also reset the minor version to 0.

Minor Version

The minor version number will be incremented where changes are made to improve the clarity, readability or understanding of the document without changing its substantive meaning or scope. This includes, but is not limited to:

• Rewording a clause to clarify what it applies to or how it applies.
• Adding examples to further explain the application or interpretation of a clause.
• Making other editorial or explanatory changes that do not alter the substantive requirements of the document.

Acceptance

Acceptance of a document is based on the major version number and is tied to the applicable contract or Statement of Work (“SoW”).

A minor version update made during an active contract or SoW will automatically apply and does not require additional acceptance, provided that the changes do not alter the substantive scope or requirements of the document.

A new major version will require acceptance under any subsequent contract or SoW. An existing contract or SoW will continue to be governed by the major version accepted at the time of agreement, unless otherwise agreed by the parties.

Accordingly, minor version updates may be made during the term of an active contract or SoW without requiring re-acceptance. A new major version will require acceptance as part of any subsequent contract or SoW.

Who

417 Tech Ltd (“we”, “us”, “our”) is a company registered in England and Wales under company number 17118754, with registered office at:

417 Tech Ltd Sparkhouse Rope Walk Lincoln England LN6 7DQ

You can contact us by post at the above address, or by any of the following other contact methods:

Phone: +44 (0) 333 44 44 417

Email: contact (at) 417-tech (dot) com

What

This document sets out publicly and internally the minimum standard by which we collect, use, retain and protect personal data belonging to clients, prospective clients and other individuals it deals with in the course of business.

As a company registered and trading in the United Kingdom, our baseline legal obligations are the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”). Thus policy is built around those requirements and applies to all personal data processed by is, regardless of the format in which it is held.

Contact

You may use the standard contact details from above to discuss this policy. In order to keep this document generic, our Data Protection Officer is not named, however they can be also be contacted directly with the following details:

Email: dpo (at) 417-tech (dot) com

Our ICO registration number is ZC200887.

Data Minimisation

In line with the UK GDPRs data minimisation principle, we only collect the personal data reasonably necessary to form and perform a contract, meet legal obligations, and run the business. As a minimum operating baseline, this is limited to:

• Client business contact details
  • Name
  • Job title
  • Business email address
  • Phone number
• Billing and account information:
  • Company name
  • Billing address
  • VAT number
  • Payment details (processed via a PCI-compliant payment provider, no details are stored by us)
• Contract and engagement records
  • Signed agreements
  • Statements of work
  • Correspondence needed to deliver the service
• Communications reasonably necessary for service delivery and support (e.g. emails)
• Where applicable:
  • Employee / HR data limited to what is required for payroll
  • Tax and employment law compliance

We do not collect special category data (e.g. health, biometric, or similarly sensitive data) about clients, and do not collect data from data subjects who are minors, unless a specific, documented business reason and lawful basis exists.

Where a client provides more personal data than this minimum (for example, personal data about their own end customers or employees embedded in project material), the client remains responsible for ensuring they have a lawful basis to share that data with us, and for instructing us accordingly under the data processing agreement where we act as a processor rather than a controller.