George Leslie Ltd is committed to protecting personal data and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. We process personal data lawfully, fairly, transparently and securely. This statement summarises our high level approach to data protection and should be read alongside our detailed Privacy Notice.
Personal Data We Process
We may collect and process personal data relating to Clients, Customers, Members of the Public, Employees, Workers, Contractors and Suppliers. This may include names and contact details, business or professional information, employment related data, information provided during business activities, and—where legally required—special category data such as health or equality information. We only collect data that is necessary, relevant and proportionate.
Lawful Basis for Processing
We process personal data only where a lawful basis under UK GDPR applies, including:
• Performance of a contract
• Compliance with a legal obligation
• Legitimate interests (including those recognised under the Data (Use and Access) Act 2025)
• Consent, where required
Further information on specific lawful bases is provided in our Privacy Notice.
Use, Retention and Security
Personal data is used only for specified and legitimate business purposes, kept accurate where reasonably possible, and retained only for as long as necessary for legal, contractual or operational reasons. Appropriate technical and organisational measures are in place to prevent unauthorised access, loss or misuse. Details of retention periods are set out in the Privacy Notice.
Data Sharing and Transfers
We do not sell personal data. Limited data may be shared with trusted third party service providers acting under our instructions and subject to appropriate contractual safeguards. We may also disclose personal data where required by law, regulation or a lawful request from a public authority. Data is currently stored and processed within the UK; if international transfers become necessary, suitable safeguards will be applied and described in the Privacy Notice.
Automated Decision Making
We do not undertake solely automated decision making that has legal or similarly significant effects, unless permitted by law and supported by appropriate safeguards. Any such processing will be explained in the Privacy Notice.
Individual Rights
Individuals have rights under data protection law, including the rights to be informed, access data, request rectification or erasure, restrict or object to processing, and data portability where applicable. Guidance on exercising these rights is provided in the Privacy Notice.
Governance and Accountability
Employees receive data protection guidance and training and are required to handle personal data responsibly. Senior accountability for data protection is assigned to an appointed senior manager in line with UK GDPR and DUAA requirements.
Enquiries and Complaints
Questions regarding this statement or our Privacy Notice should be directed to the George Leslie Ltd.
Revision 6
