GDPR Compliance Statement

Effective Date: 24 November 2025

Last Updated: 24 November 2025

Welshdale Portal is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document outlines our data protection practices and your rights as a data subject.

1. Data Controller Information

Welshdale Portal is the data controller for the personal data we process through our platform.

2. Legal Basis for Processing

We process personal data under the following lawful bases as defined by UK GDPR:

3. Categories of Personal Data Processed

3.1 Identity Data

• Full name
• Email address
• Telephone number
• Organisation/law firm name

3.2 Case Data

• Case reference numbers
• Case types and status
• Case notes and updates
• Client information related to legal cases

3.3 Document Data

• Uploaded documents and files
• Document metadata (file names, upload dates)

3.4 Technical Data

• IP addresses
• Browser type and version
• Login timestamps
• Usage patterns

3.5 Payment Data

• Payment card information (processed by Stripe - we do not store card details)
• Billing addresses
• Transaction history

4. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

5. Technical and Organisational Security Measures

5.1 Technical Security

• Encryption in Transit: TLS 1.2+ encryption for all data transmission
• Encryption at Rest: Database and file encryption for stored data
• Access Controls: Role-based access control (RBAC) and multi-factor authentication
• Secure Authentication: JWT tokens with 30-minute expiry, bcrypt password hashing
• Network Security: Firewalls, DDoS protection, intrusion detection systems
• Regular Backups: Daily automated backups with encryption
• Vulnerability Management: Regular security audits and penetration testing

5.2 Organisational Security

• Data Minimisation: We collect only data necessary for our services
• Purpose Limitation: Data used only for specified, legitimate purposes
• Storage Limitation: Data retained only as long as necessary
• Staff Training: Regular data protection training for all employees
• Confidentiality Agreements: All staff bound by confidentiality obligations
• Incident Response Plan: Documented procedures for data breach response
• Data Protection Impact Assessments: Conducted for high-risk processing

5.3 Data Isolation

We implement multi-tenant architecture with complete data isolation:

• Each organisation's data is completely isolated from others
• Users can only access data within their own organisation
• Database-level separation and access controls
• No cross-organisation data sharing

6. Data Retention Policy

Upon account closure, we will delete or anonymise your data within 90 days unless we are legally required to retain it longer (e.g., for tax or legal compliance purposes).

7. International Data Transfers

Your data is primarily stored and processed in the United Kingdom. If we transfer data outside the UK or EEA, we ensure:

• The destination country has adequate data protection laws (adequacy decision), OR
• We use Standard Contractual Clauses approved by UK authorities, OR
• We rely on other appropriate safeguards under UK GDPR

Third-Party Services: We use the following services that may involve data transfers:

• Stripe (payment processing) - Adequate safeguards in place
• Email service providers - UK/EEA based or with adequate safeguards

8. Data Breach Notification

In the event of a personal data breach that poses a risk to individuals' rights and freedoms:

• ICO Notification: We will notify the Information Commissioner's Office within 72 hours
• Individual Notification: If high risk, we will notify affected individuals without undue delay
• Content of Notification: Nature of breach, likely consequences, measures taken
• Documentation: All breaches are documented, regardless of whether notification is required

9. Data Protection Officer (DPO)

While not legally required to appoint a DPO, we have designated a data protection contact point:

10. Cookies and Tracking Technologies

We use only essential cookies necessary for the platform to function:

No Tracking: We do not use advertising cookies, analytics cookies, or third-party tracking technologies.

11. How to Complain

If you have concerns about our data protection practices:

12. Updates to This Statement

We may update this GDPR Compliance Statement from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top indicates when this statement was last revised. We will notify you of material changes by email or through a notice on the platform.

13. Contact Information