GDPR statement

ANNEXURA aims to handle personal data in a way that is consistent with the UK GDPR and the Data Protection Act 2018. We keep data collection narrow, use it for clear business purposes, and avoid holding more than we need.

The practical standard is straightforward: collect less, be clear about why it is needed, protect it properly, and keep it only for as long as the relationship or legal obligation requires.

Where we process personal data, we do so on an appropriate lawful basis. That may include taking steps at your request before entering into a contract, fulfilling a contract, complying with legal obligations, pursuing legitimate business interests, or relying on consent where consent is the right basis.

The basis depends on the nature of the interaction and the information involved.

You may have the right to request access to your personal data, ask for rectification, request erasure, restrict processing, object to processing, and request portability where applicable.

If you want to exercise one of these rights, contact us through the website contact details and we will review the request in line with applicable law.

Where third-party suppliers support hosting, analytics, communications, or operational systems, ANNEXURA expects those suppliers to handle data under appropriate contractual and security controls.

We only use external providers where they are relevant to the running of the site or the business.

If personal data is transferred outside the United Kingdom, we aim to use appropriate safeguards and practical controls proportionate to the sensitivity of the information and the service involved.

Where no transfer is needed, we prefer to keep data handling simple and local.

If you have concerns about the way ANNEXURA handles personal data, contact us first so we can try to resolve the issue directly and promptly.

You also have the right to raise a complaint with the Information Commissioner's Office if you believe your data protection rights have not been handled properly.