UK GDPR Data Protection Notice

ISM Law
Office Herwood House, 288 Southbury Road
EN1 1TR
info@ismlaw.co.uk
ismlaw.co.uk

Effective Date: 30.04.2025

1. Introduction

ISM Law (“we,” “us,” “our”) is committed to protecting and respecting your privacy. This UK GDPR Notice outlines how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We may collect and process the following types of personal data:

• Identity Data (e.g., name, date of birth, national insurance number)
• Contact Data (e.g., address, email, phone number)
• Financial Data (e.g., bank details, payment transactions)
• Technical Data (e.g., IP address, device information, browser type)
• Usage Data (e.g., interactions with our website or services)
• Special Category Data (e.g., health information, where applicable and with explicit consent)

3. How We Use Your Data

We process your personal data for the following purposes:

• To provide our services and fulfill contractual obligations
• To comply with legal and regulatory requirements
• To improve our services and customer experience
• To communicate with you regarding updates, promotions, or important notices
• To protect our business, detect fraud, and ensure security

4. Lawful Basis for Processing

Under UK GDPR, we process personal data based on the following lawful grounds:

• Consent – When you have given explicit permission (e.g., marketing emails).
• Contractual Obligation – When processing is necessary to fulfill a contract.
• Legal Obligation – When we must comply with the law (e.g., tax reporting).
• Legitimate Interests – When processing is necessary for our business interests, provided your rights do not override these interests.

5. Data Sharing & Third Parties

We do not sell your personal data. However, we may share it with:

• Service providers assisting in business operations (e.g., payment processors, IT support)
• Regulatory authorities if required by law
• Business partners where necessary for service provision

We ensure that all third parties handle your data in compliance with UK GDPR.

6. Data Retention

We retain personal data only as long as necessary for the purposes stated. Once no longer required, we securely delete or anonymize the data.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access – Request a copy of your data.
• Right to Rectification – Correct any inaccurate or incomplete data.
• Right to Erasure – Request deletion of your data (subject to legal obligations).
• Right to Restrict Processing – Limit how we use your data.
• Right to Data Portability – Request transfer of your data to another service.
• Right to Object – Object to data processing based on legitimate interests.
• Right to Withdraw Consent – If processing is based on consent, you can withdraw it at any time.

8. Data Security

We implement robust security measures to protect your data from unauthorized access, loss, or misuse. These include encryption, access controls, and regular audits.

9. Contact & Complaints

If you have any questions about this notice or wish to exercise your rights, please contact:
Data Protection Officer (DPO)
ISM Law
info@ismlaw.co.uk

If you are not satisfied with our response, you can lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Phone: 0303 123 1113

10. Changes to This Notice

We may update this notice from time to time. Any changes will be posted on our website, and where necessary, we will notify you.