Data Protection and Privacy Policy

---

Data Protection and Privacy Protection Policy

At Cardan, we take the privacy and protection of personal data seriously.

This policy outlines our commitment to protecting the privacy of our clients' personal data and complying with all applicable data protection laws and regulations.

Collection and Use of Personal Data

We collect and use personal data only for the purposes for which it was collected, such as providing ISO consultancy, internal auditing, accreditation support and training services to our clients. We will only process personal data if we have a legitimate business interest, if we have obtained the necessary consent, or if we are required to do so by law.

Processing Personal Data

We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws and regulations. Personal data is only processed by authorised personnel who have received training on data protection and privacy matters.

Data Security

We implement appropriate technical and organizational measures to ensure the security of personal data we process. This includes implementing measures to prevent unauthorized access, disclosure, or loss of personal data.

Disclosure of Personal Data

We will only disclose personal data to third parties if we have obtained the necessary consent or if we are required to do so by law. We may also disclose personal data to our authorised partners or subcontractors who assist us in providing services to our clients.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. We implement measures to ensure that personal data is securely and safely destroyed once it is no longer needed.

Client Rights

Clients have the right to access, rectify, or erase their personal data at any time. Clients may also object to the processing of their personal data, or request that their personal data be transferred to another data controller. We will promptly respond to any client requests related to their personal data.

Training and Awareness

We provide regular training and awareness programs to our personnel on data protection and privacy matters. We also ensure that our clients are informed about how we process their personal data, and their rights related to their personal data.

Contact Information

For any questions or concerns related to this policy, or to exercise your rights related to your personal data, please contact us via enquiries@cardanbusiness.co.uk

This Data Protection and Privacy Policy is subject to review and update periodically to ensure its compliance with any applicable data protection laws and regulations.

Policy Acknowledgement and Sign Off 

Name: Daniel Pemberton

Position: Director

Date: 21/01/2026