DSAR.uk is a product of Pilbeam & Co. Ltd (company number 02801554), registered office Belgrave House, 39–43 Monument Hill, Weybridge, Surrey KT13 8RN (“we”, “us”, “our”).
This policy covers website and lead data, including your work email if you use the redaction trial. Employee documents you submit for the trial, classification, redaction or bundling are described in our Data Processing Information.
1. Who we are
For website and triage data, we are the data controller. We process that data under UK GDPR and the Data Protection Act 2018.
To ask a question about this policy or about personal data we hold as controller, use the contact form on this website.
2. Data we collect
Triage and contact
If you submit the header contact form (“Talk to the team”), we may collect:
- Name, if provided
- Phone number and/or email address (at least one is required)
- Your message
- Confirmation that you are authorised to submit the information
If you submit the DSAR response triage form, we may collect:
- Work email address (required)
- Name and organisation name, if provided
- When the DSAR was received and the response deadline
- Whether the requester is a current employee, former employee, or someone else
- Where you expect relevant data to be held, other systems, approximate organisation size, and progress notes
- Confirmation that you are authorised to submit the information
We do not use the triage form to collect the employee’s DSAR file set.
Free search setup
If you submit the free search form, we may collect:
- Whether the requester is a current employee, former employee, contractor or freelancer, or other
- Selected locations that may contain connected information
- Requester identification details you provide, such as full name, previous names or aliases, work email addresses, job title, department, employment dates, and additional search terms
These answers are stored so we can prepare the search. They are not emailed as a triage lead. We do not use this form to collect the employee’s DSAR file set. Original files remain in your environment during the search.
Redaction trial
If you use the public redaction trial, we collect:
- Work email address (required), so we can send a secure link to your result and retain the enquiry
- Whether you asked to receive occasional updates about DSAR.uk
- Confirmation that you are authorised to submit the file
- The original filename and the time of submission
The PDF and DSAR subject details you enter are processed to run the trial. That file processing is described in the Data Processing Information.
Website use
- Technical data generated in the ordinary course of delivering the site, such as IP address, browser type, pages viewed and referral source
- Font files loaded from Google Fonts
3. Why we use it
| Purpose | Lawful basis |
|---|---|
| Review contact and triage enquiries, assess urgency and fit, and reply | Legitimate interests, and/or steps prior to entering a contract |
| Provide the website and keep it secure | Legitimate interests |
| Send service messages about your enquiry | Legitimate interests / contract |
| Send a secure link to a redaction trial result | Legitimate interests / steps prior to a contract |
| Send occasional product updates, if you opt in | Consent |
| Comply with legal obligations | Legal obligation |
We do not sell personal data. We do not use contact, triage or trial contact details for marketing unless you opt in to updates.
4. Who we share it with
We share data only as needed to operate the service, for example with:
- Email delivery and hosting providers
- IT support providers
- Professional advisers, or if required by law
Contact and triage submissions are sent to our operations team so we can respond. Access is limited to people who need it for that purpose.
5. International transfers
Our service providers may process data in the United Kingdom, the EEA or other countries. Where personal data is transferred outside the UK, we use appropriate safeguards required by UK data protection law, such as the UK International Data Transfer Agreement or Addendum, where applicable.
6. Retention
We keep contact form, triage, trial contact details and correspondence for as long as needed to handle the enquiry and for a limited period afterwards for operational, security and legal records. You may ask us to delete it sooner where we are not required to retain it. Trial files themselves are retained as described in the Data Processing Information.
7. Your rights
You may request access, correction, deletion, restriction, objection, or portability of personal data we hold as controller, subject to the limits in UK data protection law. You may also complain to the Information Commissioner’s Office at ico.org.uk.
To exercise these rights, contact us using the form on this website.
8. Cookies
These pages load fonts from Google Fonts. We may use strictly necessary cookies or similar storage to operate the site, the contact form and the triage form. We do not currently use advertising cookies.
9. Changes
We may update this policy by posting a new version on this page. The “Last updated” date will change when we do.