Data Privacy

While our data privacy policy is not GDPR compliant, we do use the GDPR framework as the basis for our data privacy policy because it provides more stringent requirements than local laws.

The United Kingdom’s Data Protection Act of 1998 describes how organizations must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected and used fairly, stored safely, and not disclosed unlawfully.

The Data Protection Act is underpinned by eight important principles, of which 7 apply to Treatment. These say that personal data must:

Be processed fairly and lawfully
Be obtained only for specific, lawful purposes
Be adequate, relevant and not excessive
Be accurate and kept up to date
Not be held for any longer than necessary
Processed in accordance with the rights of data subjects
Be protected in appropriate ways

Everyone who works for Treatment has some responsibility for ensuring data is collected, stored and handled appropriately. The Board of Directors is ultimately responsible for ensuring that we meet our legal obligations.

Client data is saved on secured drives that are only accessible by Treatment employees. Client data is not shared with any third party for any reason, except with the express permission of the client or where required by law. Data collected from clients is typically specific to brand guidelines, marketing strategy, or other information that does not represent any trade secret or tangible company asset of material value.

Treatment does not collect any Non-public Private Information (NPPI) from individuals. Treatment may collect and store financial information from business or independent contractors (such as bank routing and account numbers) for the sole purpose of transmitting payments electronically. This data will be deleted upon completion of any contracts.

Our statement on data privacy is shared publicly on our website.