1. Data Protection Principles

We follow the seven core principles of UK GDPR:

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

2. Data Controller

Point 1 Solutions Ltd is the data controller for information collected via our website and associated forms.
We do not sell, lease or exchange personal data with third parties.

3. Lawful Basis for Processing

• Consent – when users submit forms or request quotes.
• Contract – when processing is necessary to provide comparison or advisory services.
• Legitimate Interest – for analytics, fraud prevention, and website security monitoring.
• Legal Obligation – for record-keeping and tax compliance.

4. Data We Collect

We collect and process only the data necessary to deliver our services:

• Contact details (name, email, telephone, company)
• Business requirements submitted via our comparison forms
• Technical data (IP address, browser type, device information for security and analytics)

5. Information Security Controls

We maintain robust technical and organisational measures to protect data against loss, misuse, or unauthorised access.

• Encryption of all data in transit (HTTPS / TLS 1.3)
• Secure, UK-based hosting with redundant backup systems
• Role-based access control and strong password policies
• Endpoint protection and multi-factor authentication for staff accounts
• Annual penetration testing and vulnerability scans

6. Data Retention

Personal data is retained only as long as necessary to fulfil the purpose for which it was collected.
Standard retention periods are 12 months for enquiry data and up to 6 years for contractual records required by law.

7. Data Subject Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request corrections or erasure of your data
• Restrict or object to processing in certain circumstances
• Request a portable copy of your data
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact us at
data@compareyourbusinesscosts.co.uk.

8. Data Breach Management

Any personal-data breach will be assessed immediately by our Compliance Lead.
Where required by law, the Information Commissioner’s Office (ICO) and affected individuals will be notified within 72 hours.

9. Third-Party Processors

We only use reputable UK-based or GDPR-compliant third-party data processors (such as secure hosting and email providers).
All processors are bound by Data Processing Agreements that guarantee security and confidentiality.

10. Staff Training & Responsibilities

All employees receive mandatory data-protection training at onboarding and annual refresher sessions.
Access to personal data is granted only to those whose roles require it.

11. Policy Review

This policy is reviewed annually by the Board of Directors and our Compliance Lead to ensure ongoing alignment with UK GDPR requirements and industry best practice.

12. Contact Information

Data Protection Officer / Compliance Lead
Point 1 Solutions Ltd (t/a Compare Your Business Costs)
Email: data@compareyourbusinesscosts.co.uk
Address: London, United Kingdom