DSAR.uk is a product of Pilbeam & Co. Ltd (company number 02801554), registered office Belgrave House, 39–43 Monument Hill, Weybridge, Surrey KT13 8RN (“we”, “us”, “our”).
This policy does not cover employee documents you later submit for classification, redaction or bundling. That processing is described in our Data Processing Information.
1. Who we are
For website and triage data, we are the data controller. We process that data under UK GDPR and the Data Protection Act 2018.
To ask a question about this policy or about personal data we hold as controller, use the contact form on this website.
2. Data we collect
Triage and contact
If you submit the DSAR response triage form, we may collect:
- Work email address (required)
- Name and organisation name, if provided
- When the DSAR was received and the response deadline
- Whether the requester is a current employee, former employee, or someone else
- Where you expect relevant data to be held, other systems, approximate organisation size, and progress notes
- Confirmation that you are authorised to submit the information
We do not use the triage form to collect the employee’s DSAR file set.
Website use
- Technical data generated in the ordinary course of delivering the site, such as IP address, browser type, pages viewed and referral source
- Font files loaded from Google Fonts
3. Why we use it
| Purpose | Lawful basis |
|---|---|
| Review triage, assess urgency and fit, and reply | Legitimate interests, and/or steps prior to entering a contract |
| Provide the website and keep it secure | Legitimate interests |
| Send service messages about your enquiry | Legitimate interests / contract |
| Comply with legal obligations | Legal obligation |
We do not sell personal data. We do not use triage details for unrelated marketing unless you later agree to that.
4. Who we share it with
We share data only as needed to operate the service, for example with:
- Email delivery and hosting providers
- IT support providers
- Professional advisers, or if required by law
Triage submissions are sent to our operations team so we can respond. Access is limited to people who need it for that purpose.
5. International transfers
Our service providers may process data in the United Kingdom, the EEA or other countries. Where personal data is transferred outside the UK, we use appropriate safeguards required by UK data protection law, such as the UK International Data Transfer Agreement or Addendum, where applicable.
6. Retention
We keep triage and correspondence for as long as needed to handle the enquiry and for a limited period afterwards for operational, security and legal records. You may ask us to delete it sooner where we are not required to retain it.
7. Your rights
You may request access, correction, deletion, restriction, objection, or portability of personal data we hold as controller, subject to the limits in UK data protection law. You may also complain to the Information Commissioner’s Office at ico.org.uk.
To exercise these rights, contact us using the form on this website.
8. Cookies
These pages load fonts from Google Fonts. We may use strictly necessary cookies or similar storage to operate the site and the triage form. We do not currently use advertising cookies.
9. Changes
We may update this policy by posting a new version on this page. The “Last updated” date will change when we do.