Privacy Policy

Version 4 — Last updated: 27 May 2025

---

Key Facts (one-minute read)

• Who we are — Complete Licensing Limited (company no. 12611128), a London-based consultancy that helps hospitality and entertainment operators obtain and keep licences.
• What we collect — Identity/contact details, professional and compliance information, billing data, CCTV evidence, electronic-signature audit trails and anonymised website analytics.
• Why — To deliver our services, comply with the law, defend legal claims, improve security and—if you opt in—send newsletters.
• Sharing — With vetted UK staff/contractors, named cloud providers and regulators or police where required. Never sold.
• Storage & transfers — Mostly UK-hosted; some EU/US providers protected by Standard Contractual Clauses (SCCs) or the UK International Data-Transfer Addendum (IDTA). All e-signatures are processed in France (EU-adequate).
• Security — Cyber Essentials certified; controls aligned with ISO 27001/27701 and the NIST Privacy Framework; MFA on every account; encryption in transit & at rest.
• Retention — Client files 7 years, e-signature audit trails 10 years (eIDAS), marketing data 2 years, CVs 6 months unless you agree longer.
• Your rights — Access, rectify, erase, restrict, object, data portability, withdraw consent & complain to the ICO.
• Quick contact — [email protected] | 0207 222 2345 | [email protected] (24 × 7 for vulnerabilities)

---

1 Who We Are

We are the controller under the UK GDPR and the Data Protection Act 2018.

---

2 Changes to This Policy & Effectiveness Review

We review this Policy at least annually and whenever legislation or our practices change. Effectiveness is tested quarterly via random file reviews, KPI dashboards and an annual external audit. Material updates are flagged directly to clients where feasible.

Version history

---

3 Data We Collect

We do not intentionally collect special-category data (e.g. health) except where unavoidable (e.g. CCTV) and we never knowingly collect data from anyone under 16 outside the scenario above.

---

4 How We Collect Your Data

• Secure online forms and document-upload links
• Direct communications (email, phone, post, in person)
• Evidence supplied by clients or obtained from public authorities
• Automated collection via cookies and analytics (see § 12)

---

5 Lawful Bases for Processing

We rely on one or more of the following lawful bases under UK GDPR:

1. Contract – to enter into or perform our contract with you.
2. Legal obligation – to meet statutory or regulatory duties (e.g. anti-money-laundering checks).
3. Legitimate interests – our legitimate business interest in providing licensing services and defending clients, provided these interests are not overridden by your rights (we record legitimate-interest assessments).
4. Consent – for optional activities such as marketing emails; you may withdraw consent at any time.
5. Legal claims / vital interests – to establish, exercise or defend legal claims, or protect life.

We do not carry out automated decision-making that produces legal or similarly significant effects.

---

6 How We Use Your Data

• Preparing, submitting and managing licence and permit applications
• Representing or defending clients in licensing reviews, criminal proceedings or regulatory investigations
• Liaising with police and responsible authorities on clients’ behalf
• Performing Know-Your-Customer (KYC) and anti-money-laundering checks
• Maintaining internal records, accounts and audits
• Handling electronic signatures via Yousign and storing signed documents and audit trails
• Communicating urgent service, security or billing matters (including limited-purpose SMS)
• Sending newsletters and updates where you have opted in or the “soft opt-in” applies
• Improving services, website and security through pseudonymised analytics
• Training staff and improving service quality (e.g. by reviewing anonymised calls)

Artificial intelligence – We do not currently use AI or machine-learning systems to profile individuals or make automated decisions. If that changes, this Policy will be updated before deployment.

---

7 Who We Share Your Data With

7.1 Internal

Employees and vetted UK-based contractors, all trained in data protection and bound by confidentiality.

7.2 Approved Service Providers (Sub-processors)

*Where a provider offers regional choice, the table shows our configured region.

**Safe Point processes staff location data only—listed for transparency.

PDF workflow – PDFs are edited locally on encrypted company devices using PDF Expert. When electronic signatures are required, documents are uploaded to Yousign’s EU data-centres; the signed PDF and audit-trail are then stored back in Egnyte/Microsoft 365.

A current sub-processor list is always available at /sub-processors.

7.3 Regulators & Law-enforcement Authorities

We may share data with licensing authorities, police, courts or HMRC where required by law or necessary to defend our clients’ legal rights.

We never sell personal data.

---

8 International Transfers

Data are stored in the UK wherever practicable. Where a provider processes data outside the UK (e.g. USA), we rely on:

• the UK International Data-Transfer Addendum (IDTA) to the EU Standard Contractual Clauses;
• an adequacy decision (for EU/EEA locations such as France); or
• binding corporate rules or another UK-approved mechanism.

All e-signature data are processed within France (EU-adequate), so no additional transfer mechanism is required. For every transfer to a non-adequate country we complete a UK Transfer Risk Assessment (TRA) and adopt ICO-recommended supplementary measures.

---

9 Data Retention

Data reaching end-of-life are securely shredded or irreversibly erased using NCSC-approved tools.

---

10 Security Measures

10.1 Governance & Certification

• Cyber Essentials certificate ID 15c19be6-e562-4231-8484-0206e33fa373 (valid to 4 September 2025).
• Controls aligned with ISO 27001 and ISO 27701; privacy programme mapped to the NIST Privacy Framework v1.0.

10.2 Identity & Access Management

• Single Sign-On and enforced Multi-Factor Authentication
• Role-based least-privilege access; automated de-provisioning

10.3 Network & Infrastructure

• AES-256 encryption at rest; TLS 1.2+ (TLS 1.3 preferred) in transit
• Cloudflare Web Application Firewall & DDoS mitigation
• Weekly vulnerability scans; annual external penetration test
• Local PDF workflow – PDFs edited and signed on-device via PDF Expert

10.4 Email & Messaging

• Inky inbound filtering and malware/phishing defence
• SPF, DKIM & DMARC (p=reject) with MTA-STS and DANE; failure reports monitored
• Internal email end-to-end encrypted (Microsoft 365); full message encryption on request
• Confidential internal chat via Signal or Microsoft Teams (E2EE)

10.5 Data-Loss Prevention & Backup

• Microsoft 365 DLP policies
• Daily encrypted off-site backups (separate UK data centre); monthly restore tests

10.6 Training & Awareness

• Mandatory induction and annual refresher training
• Quarterly simulated phishing campaigns

10.7 Incident Response

• Documented plan; 24 × 7 duty officer
• ICO notified within 72 hours where required; affected individuals informed without undue delay

10.8 Data-Protection Impact Assessments (DPIAs)

We conduct a DPIA before we:

1. introduce new technology that processes special-category data;
2. carry out systematic monitoring;
3. process special-category data on a large scale; or
4. undertake any ICO-listed high-risk activity.

DPIA summaries are available to clients under NDA.

---

11 Marketing & Communications

• Emails – sent only with your opt-in or under the “soft opt-in” for existing clients. Mailchimp pixels record open rates and aggregate engagement, used solely to improve content. You can unsubscribe at any time.
• SMS – used sparingly for overdue-payment reminders, urgent service alerts or two-factor-authentication links.
• Post & phone – we do not conduct unsolicited postal or telephone marketing.

---

12 Cookies & Website Analytics

We use optional analytical cookies served by Google Analytics. They are set only if you accept them on the banner shown on your first visit; if you reject or ignore it, no analytics cookies are set and nothing is requested from Google. Advertising and personalisation signals are disabled permanently.

Your choice is stored in your browser’s local storage rather than in a cookie, and you can change it at any time through the Cookie settings link in the footer. See our full Cookie Policy for a category-by-category list.

---

13 Children’s Data

Our services target professionals and businesses. We do not knowingly process data relating to individuals under 18 except where strictly necessary to investigate alleged age-restricted sales, and such data are deleted immediately after the investigation.

---

14 Your Data-Protection Rights

Under the UK GDPR and the Data Protection Act 2018 you enjoy the rights set out below. The simplest way to exercise any right is to email [email protected] with the subject “Data-rights request”. We aim to acknowledge receipt within two working days.

14.11 How we handle a request

• Identification – we may ask for proof of ID or authority.
• Time-frame – we respond within one calendar month; complex requests may take up to two extra months.
• Fees – the first copy is free; we may charge for excessive or unfounded requests.
• Format – responses are normally electronic unless you ask otherwise.

---

15 Contact Us

• Email (privacy queries): [email protected]
• Email (security & vulnerabilities): [email protected] (24 × 7)
• Telephone: 020 4621 7798
• Post: Complete Licensing Limited, 11 Forest Drive, Woodford Green, Essex IG8 9NG
• Web form: https://completelicensing.uk/contact

If you need this Policy in an alternative format (large print, audio, easy-read) please let us know.

---

Appendix A Glossary