1. Our commitment to data protection
VoltaServices Limited (“we”, “us”, “our”) is committed to protecting the privacy and security of your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This notice explains your rights under UK GDPR and describes the measures we take to protect your data. It should be read alongside our Privacy Policy, which provides full details on how we collect, use, and store personal data.
2. Data controller & supervisory registration
VoltaServices Limited is the registered data controller for personal data collected through our website, communications channels, and managed infrastructure operations.
3. Your rights under UK GDPR
Under the UK GDPR, you have the following rights. These rights are not absolute and may be subject to certain conditions and exemptions.
Right of access
You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond within one month of receiving your request.
Right to rectification
You have the right to request that we correct any personal data that is inaccurate or incomplete.
Right to erasure
You have the right to request the deletion of your personal data where there is no compelling reason for us to continue processing it. This is also known as the “right to be forgotten”.
Right to restrict processing
You have the right to request that we limit the way we use your data. When processing is restricted, we may store your data but will not process it further without your consent.
Right to data portability
You have the right to request that we transfer the personal data you provided to us to another organisation, or directly to you, in a structured, commonly used, machine-readable format.
Right to object
You have the right to object to processing of your personal data where we rely on legitimate interests as our lawful basis, or where data is processed for direct marketing purposes.
Right to withdraw consent
Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Rights related to automated decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. We do not currently carry out automated decision-making.
4. How to exercise your rights
To exercise any of the rights described above, please contact us using the details below. We may need to verify your identity before processing your request.
- Email: sales@voltaservices.uk
- Subject line: "GDPR Request — [Your Name]"
We will acknowledge your request within 72 hours and respond fully within one calendar month. If your request is complex or we receive a high volume of requests, we may extend this period by up to two additional months, and we will inform you if this is the case.
5. Lawful bases for processing
We process personal data only where we have a lawful basis to do so. The lawful bases we rely on include:
- Consent: You have given clear consent for us to process your personal data for a specific purpose.
- Contract: Processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract.
- Legitimate interests: Processing is necessary for our legitimate business interests, provided your rights do not override those interests.
- Legal obligation: Processing is necessary to comply with a legal or regulatory obligation.
6. Data protection measures
We implement appropriate technical and organisational measures to ensure the security of your personal data, including:
- Encryption of data in transit using SSL/TLS.
- Secure hosting infrastructure with regular security updates.
- Access controls limiting who can view personal data to authorised personnel only.
- Regular review of data processing activities and security practices.
- Data minimisation — we collect only the data necessary for the stated purpose.
7. Data breach procedures
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
- Document the breach, its effects, and the remedial action taken.
8. International data transfers
We primarily process and store personal data within the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in accordance with UK GDPR requirements.
9. Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are based on business need and legal requirements. For more detail, see our Privacy Policy.
10. Children's data
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.
11. Complaints
If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns directly before you approach the ICO. Please contact us at sales@voltaservices.uk in the first instance.
12. Updates to this notice
We may update this GDPR notice from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated “Last updated” date.