Information held responsibly. Protected by design.

This policy applies to:

• All employees, directors, subcontractors, and temporary staff
• All company systems, devices, software, and communications
• All customer, employee, supplier, and operational information
• All physical and digital records managed by the organisation

Technical Lift Services Ltd. undertakes to:

• Process personal data lawfully, fairly, and transparently
• Collect only information necessary for legitimate business purposes
• Ensure personal data is accurate and kept up to date
• Retain data only for as long as operational or legal requirements dictate
• Protect data against unauthorised access, loss, destruction, or disclosure
• Respect the rights of individuals regarding access, correction, and deletion of data where applicable

Responsibility for data protection compliance is managed at director level.

The organisation has implemented technical and organisational measures designed to protect company and customer information:

Technical Lift Services Ltd. holds Cyber Essentials Plus certification, independently verified against the National Cyber Security Centre (NCSC) backed scheme. This certification demonstrates compliance with recognised cyber security controls including:

• Secure configuration
• User access control
• Malware protection
• Security update management
• Firewall implementation
• Vulnerability testing and technical verification

The company maintains ongoing compliance through continual review and management of cyber security risks.

Employees and subcontractors must:

• Handle customer and company information responsibly
• Only access information necessary for their role
• Not disclose confidential information without authorisation
• Report any suspected data breaches, cyber incidents, or security concerns immediately
• Follow company procedures relating to information security and GDPR compliance

Confidentiality obligations apply during and after employment or engagement with the company.

Technical Lift Services Ltd. actively assesses and manages risks associated with:

• Cyber threats and phishing attacks
• Unauthorised access to systems or information
• Loss or corruption of operational data
• Misuse of company devices or systems
• Third-party supplier and subcontractor access

Any actual or suspected data breach must be reported immediately to company management. The organisation will:

• Investigate the incident promptly
• Take appropriate corrective action
• Assess legal reporting obligations
• Notify affected parties and regulatory authorities where required

Technical Lift Services Ltd. promotes a culture of security awareness throughout the organisation. Staff are expected to:

• Follow company security procedures
• Exercise vigilance regarding suspicious emails and communications
• Maintain secure password practices
• Handle customer information professionally and responsibly

This policy will be reviewed periodically and updated where necessary to reflect:

• Legislative changes
• Operational requirements
• Emerging cyber security threats
• Industry best practice