Data Protection Policy

1. Policy Statement, Scope and Objectives

1.1 Policy Statement

The proprietor of e4 Vans & e4 Finance,
e4 House, Cedar Way, Tonyrefail, Porth, RCT CF39 8JN,
is committed to full compliance with all applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Data Protection Registration Number: ZC085866

We are committed to protecting the rights and freedoms of individuals whose personal data we collect, process or store.

To support this commitment, the Board has established, implemented and maintains a Personal Information Management System (PIMS), which is subject to continuous review and improvement.

1.2 Scope

This policy applies to:

  • All employees, proprietor and contractors
  • Temporary staff and agency workers
  • Third parties, suppliers and partners who process personal data on our behalf

The PIMS takes into account our organisational structure, management responsibilities, jurisdiction and geographical location.

1.3 Objectives of the PIMS

The objectives of the PIMS are to ensure that:

  • Personal data is managed securely and responsibly
  • Legal, regulatory and contractual obligations are met
  • Risks relating to personal data are identified and controlled
  • Individuals’ rights and freedoms are protected
  • Accountability and transparency are embedded throughout the organisation

1.4 Data Protection Commitments

e4 Vans & e4 Finance commits to:

  • Processing personal data only where there is a lawful and legitimate basis
  • Collecting only data that is relevant and necessary
  • Being transparent about how personal data is used
  • Keeping personal data accurate and up to date
  • Retaining data only for as long as necessary
  • Respecting individuals’ data protection rights
  • Ensuring appropriate technical and organisational security measures
  • Preventing unauthorised or unlawful processing
  • Restricting transfers outside the UK/EEA unless adequate safeguards exist
  • Maintaining records of processing activities
  • Assigning clear responsibility and accountability for data protection

2. Notification and Registration

e4 Vans & e4 Finance is registered with the Information Commissioner’s Office (ICO) as a data controller.

Data Protection Registration Number: ZC085866

  • ICO registration is reviewed annually
  • Registration details are held by the Data Protection Officer (DPO)
  • Any material changes to processing activities are assessed and updated as required

3. Application of This Policy

This policy applies to all staff and relevant third parties.

Any breach of this policy or UK GDPR may result in disciplinary action and, where appropriate, referral to regulatory or law enforcement authorities.

Third parties must not access personal data without a written data processing or confidentiality agreement that meets UK GDPR standards.

4. Background to UK GDPR

The UK GDPR replaces the EU Data Protection Directive and strengthens individuals’ rights over their personal data.

Its purpose is to ensure that personal data is:

  • Processed lawfully, fairly and transparently
  • Used only for specified purposes
  • Adequate, relevant and limited
  • Accurate and secure

5. Key Definitions

Definitions used in this policy align with UK GDPR and include:

  • Personal Data
  • Special Category Data
  • Data Controller
  • Data Processor
  • Data Subject
  • Processing
  • Profiling
  • Personal Data Breach
  • Consent
  • Child (under 13 years)
  • Third Party
  • Filing System

(Full GDPR definitions apply.)

6. Roles and Responsibilities

6.1 Data Controller and Processor

e4 Vans & e4 Finance acts as both a data controller and, where applicable, a data processor.

6.2 Management Responsibility

Managers and supervisors are responsible for promoting good data protection practices within their areas of responsibility.

6.3 Data Protection Officer (DPO)

The Data Protection Officer:

  • Is accountable to the Board
  • Oversees compliance with UK GDPR
  • Maintains the PIMS
  • Manages risk and security relating to personal data
  • Is the first point of contact for data protection queries

6.4 Staff Responsibilities

All staff are responsible for:

  • Complying with this policy
  • Protecting personal data they handle
  • Reporting data breaches or concerns promptly
  • Ensuring data they provide is accurate and up to date

7. Risk Assessment & DPIAs

e4 Vans & e4 Finance carries out risk assessments to identify and manage risks to individuals arising from data processing.

Where processing may present a high risk to rights and freedoms, a Data Protection Impact Assessment (DPIA) will be completed before processing begins.

Significant risks or unresolved concerns will be escalated to the ICO where required.

8. Data Protection Principles

All personal data must be:

  1. Processed lawfully, fairly and transparently
  2. Collected for specified and legitimate purposes
  3. Adequate, relevant and limited
  4. Accurate and kept up to date
  5. Retained only as long as necessary
  6. Processed securely
  7. Protected against unauthorised access, loss or destruction

9. International Data Transfers

Personal data must not be transferred outside the UK/EEA unless:

  • An adequacy decision exists, or
  • Appropriate safeguards are in place, or
  • A lawful GDPR exception applies

10. Accountability

We maintain records of processing activities and demonstrate compliance through:

  • Policies and procedures
  • Training and awareness
  • Security controls
  • DPIAs
  • Incident and breach management

11. Data Subject Rights

Individuals have the right to:

  • Access their personal data
  • Rectify inaccurate data
  • Request erasure
  • Restrict processing
  • Data portability
  • Object to processing or profiling
  • Not be subject to automated decisions
  • Claim compensation

Requests are handled in accordance with our Subject Access Request procedure.

12. Consent

Consent must be:

  • Freely given
  • Specific
  • Informed
  • Unambiguous

Consent can be withdrawn at any time.
Silence or inactivity does not constitute consent.

For children under 13, parental or guardian consent is required.

13. Data Security

Personal data must be:

  • Accessed only by authorised personnel
  • Stored securely (physical and electronic)
  • Encrypted where appropriate
  • Disposed of securely in line with retention policies

Off-site processing requires specific authorisation.

14. Disclosure of Personal Data

Personal data must not be disclosed unless:

  • Legally required
  • Necessary for legitimate business purposes
  • Authorised by the Data Protection Officer

All disclosures must be documented.

15. Retention and Disposal

Personal data is retained only for as long as necessary and disposed of securely when no longer required.

COMPLAINTS PROCEDURE (DATA PROTECTION)

1. Scope

This procedure applies to complaints relating to the handling of personal data.

2. Responsibility

All complaints must be reported to the Director(s), who are responsible for resolution.

3. How to Make a Complaint

You may raise a complaint by contacting us:

Complaints Department
e4 Vans & e4 Finance
e4 House, Cedar Way
Tonyrefail, Porth
RCT CF39 8JN

📞 01443 676494
📧 Lee@e4vans.co.uk

Please include:

  • Your name and contact details
  • Full details of the complaint
  • What outcome you are seeking
  • Supporting documents (if any)

4. Our Response

  • Acknowledgement within 5 business days
  • Final response within 30 days
  • Updates provided if delays occur

5. Escalation

If you remain dissatisfied, you may complain to the ICO:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF

Website: ico.org.uk

Implemented: 19/01/2026 – Last Update: 19/01/2026