GDPR Compliance

Last updated: August 2026

SAL Digital is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines our compliance measures.

1. ICO Registration

SAL Digital is registered with the Information Commissioner's Office (ICO), the UK's independent authority set up to uphold information rights. Our registration details are available on request.

2. Data Protection Responsibility

While we are not currently required to appoint a Data Protection Officer under UK GDPR, we have designated a responsible individual to oversee data protection compliance. You can contact them at contact@saldigital.co.

3. Lawful Basis for Processing

We only process personal data where we have a valid lawful basis under Article 6 of UK GDPR:

Contractual necessity: To deliver the services you have subscribed to
Consent: For marketing communications (you can withdraw consent at any time)
Legitimate interests: For business operations, fraud prevention, and service improvement
Legal obligation: For tax, accounting, and regulatory compliance

4. Data Subject Rights

We respect and facilitate the following rights for all data subjects:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will respond within 30 days free of charge.

Right to Rectification

If any data we hold about you is inaccurate or incomplete, you have the right to request correction.

Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data where there is no compelling reason for us to continue processing it. We will comply unless we have a legal obligation to retain the data.

Right to Restrict Processing

You can ask us to restrict processing of your data in certain circumstances, such as when you contest its accuracy.

Right to Data Portability

You can request your data in a structured, commonly used, and machine-readable format (e.g. CSV) to transfer to another service provider.

Right to Object

You have the right to object to processing based on legitimate interests or direct marketing. We will stop processing unless we demonstrate compelling legitimate grounds.

5. Data Security Measures

We implement the following technical and organisational measures:

SSL/TLS encryption for all data in transit
Secure cloud hosting with regular security patches
Role-based access controls — staff only access data necessary for their role
Regular data protection training for all team members
Incident response plan for data breaches
Regular backups with encrypted storage

6. Data Breach Notification

In the unlikely event of a personal data breach, we will:

Notify the ICO within 72 hours if the breach is likely to result in a risk to individuals' rights and freedoms
Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms
Document all breaches, including their effects and remedial actions taken

7. International Data Transfers

We primarily process data within the UK and European Economic Area (EEA). Where we use third-party services that may transfer data outside the UK/EEA (e.g. Google, Meta, Stripe), we ensure adequate safeguards are in place through Standard Contractual Clauses (SCCs) or equivalent mechanisms.

8. Data Retention

We retain personal data only for as long as necessary:

Active customer data: Duration of subscription plus 30 days
Financial records: 6 years (UK tax law requirement)
Marketing consent data: Until consent is withdrawn
Website analytics: 26 months

9. Exercising Your Rights

To exercise any of your GDPR rights, please contact us:

We will respond to all requests within 30 days. Complex requests may take up to 60 days, in which case we will notify you.

10. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the ICO:

Website: ico.org.uk
Phone: 0303 123 1113

11. Updates

We review our compliance measures regularly and update this page as needed. The "Last updated" date at the top of this page indicates when changes were last made.