GDPR Policy
Comprehensive Guide to Our Data Protection Practices
Mouldsurv Ltd is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This comprehensive policy explains how we process personal data in accordance with the highest standards of data protection.
What is GDPR?
The UK General Data Protection Regulation (UK GDPR) is a comprehensive data protection law that came into effect on 25 May 2018 and was retained in UK law following Brexit. It sets strict requirements for how organisations collect, store, process, and share personal data.
As a UK-based mould and damp survey specialist, we handle personal data including client details, property information, and health-related survey records. We take our GDPR obligations seriously and have implemented robust policies and procedures to protect your data.
Our Data Protection Registration: We are registered with the Information Commissioner's Office (ICO), the UK's independent data protection authority.
The 7 Principles of GDPR
We adhere to the seven key principles set out in Article 5 of UK GDPR:
1. Lawfulness, Fairness and Transparency
We process your data lawfully, fairly, and in a transparent manner. We clearly explain what data we collect and why, providing accessible privacy information at the point of collection.
2. Purpose Limitation
We collect personal data for specified, explicit, and legitimate purposes only. Data collected for mould surveys will not be used for unrelated purposes without your consent.
3. Data Minimisation
We only collect data that is adequate, relevant, and limited to what is necessary. We do not request excessive information beyond what is required for our services.
4. Accuracy
We take reasonable steps to ensure personal data is accurate and kept up to date. You can request corrections at any time, and we will act promptly to rectify inaccuracies.
5. Storage Limitation
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law (e.g., 40 years for health and safety records under HHSRS).
6. Integrity and Confidentiality (Security)
We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or damage.
7. Accountability
We are responsible for demonstrating compliance with all GDPR principles. We maintain comprehensive records of our data processing activities and conduct regular compliance audits.
Your GDPR Rights Explained
Under UK GDPR, you have comprehensive rights over your personal data:
Right to be Informed
You have the right to clear and transparent information about how we collect and use your personal data. This policy and our Privacy Policy fulfil this obligation.
How to exercise: We provide privacy notices at the point of data collection (e.g., contact forms, survey bookings).
Right of Access (Subject Access Request)
You have the right to obtain confirmation that we are processing your data and to access a copy of your personal data.
How to exercise: Submit a request to enquiries@oxford-ec.co.uk. We will respond within one month and provide your data in a structured, commonly used format free of charge.
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
How to exercise: Contact us with the corrected information. We will update our records within one month and notify any third parties with whom we have shared your data.
Right to Erasure ("Right to be Forgotten")
You can request deletion of your personal data in certain circumstances, such as when data is no longer necessary for its original purpose.
How to exercise: Note: This right is not absolute. We may need to retain certain data for legal compliance (e.g., HHSRS health records for 40 years, financial records for 7 years).
Right to Restrict Processing
You can request that we limit how we use your data while we investigate accuracy concerns or respond to an objection.
How to exercise: We will mark your data as restricted and only process it with your consent or for legal claims.
Right to Data Portability
You can obtain and reuse your personal data for your own purposes across different services.
How to exercise: We will provide your data in a structured, machine-readable format (e.g., CSV, JSON) where technically feasible.
Right to Object
You can object to processing based on legitimate interests or direct marketing.
How to exercise: For direct marketing: We will stop immediately. For legitimate interests: We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
How to exercise: We do not currently use automated decision-making or profiling that would significantly affect you.
Exercising Your Rights
To exercise any of these rights, contact our Data Protection Officer:
- Email: enquiries@oxford-ec.co.uk
- Phone: 03456 868 868
- Post: Data Protection Officer, Oxford Environmental Consultants Ltd, Suite 1A, Unit 5 Wickham Business Park, Honywood Road, Basildon, Essex, SS14 3EQ
We will respond to your request within one month (extendable to three months for complex requests).
Legal Basis for Processing Your Data
Under Article 6 of UK GDPR, we must have a lawful basis to process your personal data. We rely on the following:
1. Consent (Article 6(1)(a))
You have given clear, specific, informed consent for us to process your personal data for a specific purpose.
Examples: Marketing communications, optional contact preferences, newsletter subscriptions.
Your rights: You can withdraw consent at any time by emailing enquiries@oxford-ec.co.uk.
2. Contract (Article 6(1)(b))
Processing is necessary for us to perform our contract with you or to take steps at your request before entering into a contract.
Examples: Booking a mould survey, conducting inspections, preparing reports, processing payments.
3. Legal Obligation (Article 6(1)(c))
Processing is necessary for us to comply with the law.
Examples: Retaining health and safety records for 40 years (HHSRS requirement), keeping financial records for 7 years (HMRC), HSE reporting obligations.
4. Legitimate Interests (Article 6(1)(f))
Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights override those interests.
Examples: Fraud prevention, network security, business administration, improving our services.
Your rights: You have the right to object to processing based on legitimate interests.
Special Category Data
UK GDPR identifies certain types of personal data as "special category" requiring higher levels of protection. This includes data revealing racial or ethnic origin, health data, genetic data, and biometric data.
Health Data in Mould Surveys
Mould surveys may involve processing health-related data when occupants report respiratory issues, allergies, or other health concerns potentially linked to mould exposure.
Our legal basis for processing health data: Article 9(2)(h) - necessary for health and safety purposes, specifically:
- Assessing health risks under the Housing Health and Safety Rating System (HHSRS)
- Compliance with Health and Safety Executive (HSE) regulations
- Protecting public health by identifying mould hazards
Enhanced Protection Measures
- Health data is stored separately with additional encryption
- Access is restricted to authorised personnel only
- Retained for 40 years as required by HHSRS for health and safety records
- Shared only with UKAS-accredited laboratories under strict data processing agreements
Data Breach Notification
Under UK GDPR Articles 33 and 34, we are required to report certain types of personal data breaches to the ICO and, in some cases, to affected individuals.
Our Data Breach Response Plan
- 1
Detection & Containment
Immediate action to contain the breach and prevent further data loss (within 24 hours)
- 2
Assessment
Evaluate the severity, scope, and risk to individuals within 72 hours
- 3
ICO Notification
Report to the ICO within 72 hours if the breach is likely to result in a risk to individuals' rights and freedoms
- 4
Individual Notification
Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms
- 5
Documentation
Record all breaches (reported or not) in our internal breach register, documenting facts, effects, and remedial actions
- 6
Review & Prevention
Conduct a post-incident review and implement measures to prevent recurrence
What we will tell you: If we need to notify you of a breach, we will explain what happened, what data was affected, the likely consequences, and what steps we are taking to address the breach and mitigate harm.
International Data Transfers
UK GDPR restricts the transfer of personal data outside the UK to ensure your data receives the same level of protection wherever it is processed.
Our Current Position
We primarily process personal data within the United Kingdom. However, some of our service providers (e.g., cloud hosting, email services) may process data outside the UK.
Where we transfer data internationally, we ensure appropriate safeguards are in place:
- UK adequacy decisions: Transfers to countries deemed to provide adequate data protection by the UK government
- Standard Contractual Clauses (SCCs): EU/UK-approved contract templates that bind the recipient to protect your data
- Binding Corporate Rules (BCRs): For transfers within multinational corporate groups
- Certification schemes: Such as EU-U.S. Data Privacy Framework (if re-established with UK equivalence)
Children's Privacy
UK GDPR provides enhanced protection for children's personal data, recognising that children may be less aware of risks and their rights.
Our Policy
- We do not knowingly collect personal data directly from children under 13
- For children aged 13-17, we require parental or guardian consent before processing personal data
- Mould survey records may include information about children as occupants affected by damp/mould, processed under our legal obligation for health and safety compliance
- Parents/guardians can request access to, correction, or deletion of their child's data by contacting our Data Protection Officer
Cookies and Online Tracking
UK GDPR works alongside the Privacy and Electronic Communications Regulations (PECR), which govern the use of cookies and similar tracking technologies.
Cookies We Use
Strictly Necessary Cookies
Essential for the website to function properly. These do not require consent.
Examples: Session management, security tokens, load balancing
Performance/Analytics Cookies
Help us understand how visitors use our website (e.g., Google Analytics).
We anonymise IP addresses and have data processing agreements in place.
Functionality Cookies
Remember your preferences (e.g., cookie consent choices).
Your Cookie Choices: You can control cookies through your browser settings and our cookie consent banner. Note that blocking certain cookies may affect website functionality.
Data Protection Impact Assessments (DPIAs)
Under Article 35 of UK GDPR, we must conduct a Data Protection Impact Assessment (DPIA) before undertaking any processing that is likely to result in a high risk to individuals' rights and freedoms.
When We Conduct DPIAs
- •Introducing new data processing technologies or systems
- •Processing special category data (e.g., health information) at scale
- •Systematic monitoring of publicly accessible areas
- •Large-scale processing of personal data
- •Using new or innovative technologies (e.g., AI, automated decision-making)
Our DPIAs systematically describe the processing, assess necessity and proportionality, identify and assess risks to individuals, and determine measures to mitigate those risks. Where a DPIA indicates high residual risk, we consult with the ICO before proceeding.
Complaints and Enforcement
How to Raise a Data Protection Concern
If you have concerns about how we handle your personal data, please contact our Data Protection Officer first:
Email: enquiries@oxford-ec.co.uk
Phone: 03456 868 868
Post: Data Protection Officer, Oxford Environmental Consultants Ltd, Suite 1A, Unit 5 Wickham Business Park, Honywood Road, Basildon, Essex, SS14 3EQ
We aim to resolve all complaints within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority.
Information Commissioner's Office (ICO)
The ICO is the UK's independent supervisory authority for data protection. You have the right to lodge a complaint at any time:
Website: www.ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Updates to This GDPR Policy
We may update this GDPR Policy periodically to reflect changes in our data processing practices, legal requirements, or regulatory guidance from the ICO.
Last Updated: January 1, 2026
Version: 1.0
Significant changes will be communicated via email to registered users or prominently displayed on our website.
Related Policies
For more information about our data practices, please also refer to: