GDPR & Data Protection
Last updated: July 2026
Our commitment
We are committed to protecting the privacy and security of personal data, and comply with UK GDPR and the Data Protection Act 2018. A Data Protection Officer (DPO) oversees compliance.
Data Protection Officer
Our DPO can be contacted at dpo@trmn.co.uk for any data protection query, request or concern. The DPO reports to the board and has independent oversight of compliance.
Principles
We follow the seven principles of UK GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Special category data
We do not knowingly collect special category data (health, ethnicity, religion, biometric, trade union membership) except where strictly necessary for safeguarding, employment or legal compliance, and only with explicit consent or another Article 9 condition.
Data subject rights
You have the right to: be informed; access; rectification; erasure; restrict processing; data portability; object; rights regarding automated decision-making and profiling. Requests can be made to our DPO and are actioned within one calendar month.
Lawful basis for processing
We rely on: (a) performance of a contract; (b) compliance with legal obligation; (c) legitimate interests balanced against your rights; (d) consent where required. Full details are in the Privacy Policy above.
International transfers
Personal data is stored within the UK and EEA. Any transfer outside this area uses appropriate safeguards including the UK International Data Transfer Addendum, adequacy regulations or standard contractual clauses.
Data breaches
We maintain a documented incident response plan. Personal data breaches are assessed and, where they pose a risk to rights and freedoms, notified to the ICO within 72 hours and to affected individuals without undue delay. You can report a suspected breach to security@trmn.co.uk.
Sub-processors
We use vetted sub-processors including hosting providers, payment processors and email platforms. A current list of sub-processors is available on request. All are bound by written data processing agreements meeting Article 28 requirements.
Retention
Data is kept only as long as necessary for the purpose for which it was collected. Verification and employment records are retained for six years post-engagement; inactive accounts are reviewed annually. Full schedules are available on request.
Your right to complain
If you are unhappy with our response to a data request, you have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Questions? Email the relevant contact above.