Data Protection

---

 Data Protection Policy

1. Introduction

Intelligent Structural Solutions Ltd (“ISS”) collects and uses certain types of personal information relating to individuals, clients, suppliers, and service users in order to carry out its professional activities.

This information may be collected on paper, electronically, or by other means, and must be handled responsibly and securely in accordance with the UK General Data Protection Regulation (UK GDPR)and the Data Protection Act 2018.

ISS recognises the importance of protecting personal information and is committed to ensuring that it is processed lawfully, fairly, and transparently at all times.

2. Data Controller

The Data Controller is Geert Hindrik van Boven, who determines the purposes for which personal data is collected, held, and processed, and ensures compliance with data protection legislation.

3. Data Use and Disclosure

ISS collects personal data solely for legitimate business purposes, including:

• administering projects and client relationships;
• preparing and issuing invoices;
• fulfilling contractual and legal obligations; and
• maintaining efficient internal operations.

ISS does not routinely share personal data with external parties. However, in limited cases, information may be shared with sub-consultants or subcontractors appointed to assist on a project. Any shared information will be restricted to what is necessary for the delivery of our professional services.

Personal data may also be disclosed without consent when permitted or required by law, for example:

• to protect the vital interests of an individual;
• in connection with legal proceedings or to obtain legal advice; or
• to comply with lawful obligations under legislation or regulation.

ISS treats all personal data lawfully and securely and is committed to maintaining the confidence of all clients, suppliers, and individuals with whom it interacts.

4. Data Protection Principles

ISS adheres to the following principles of data protection as set out under the UK GDPR. Personal data shall:

1. Be processed lawfully, fairly, and transparently.
2. Be collected only for specific, explicit, and legitimate purposes.
3. Be adequate, relevant, and limited to what is necessary.
4. Be accurate and, where necessary, kept up to date.
5. Not be kept for longer than necessary.
6. Be kept secure using appropriate technical and organisational      measures.

ISS will ensure that personal information is handled correctly by:

• Observing fair collection and use practices;
• Meeting all legal obligations relating to data protection;
• Ensuring information quality and accuracy;
• Limiting access to authorised personnel only;
• Maintaining appropriate cybersecurity controls; and
• Treating individuals fairly and without discrimination when      handling data.

5. Data Collection and Consent

ISS will ensure that individuals clearly understand why their personal data is required, how it will be used, and with whom it may be shared before it is collected.

Informed consent will be obtained where required, ensuring that individuals have the opportunity to agree—or decline—to the proposed use of their personal data.

Data collection applies to all methods, including face-to-face meetings, digital forms, or other communications.

6. Data Storage and Retention

All personal data and project records are stored securely, either electronically with password protection and restricted access, or in locked physical storage where appropriate.

Information will be retained only for as long as necessary for business, legal, or insurance purposes, after which it will be securely deleted or destroyed.

ISS will also ensure that all data is irretrievable from any computer system or device that is sold, recycled, or otherwise disposed of.

7. Data Access, Accuracy, and Rights

All individuals have the right to request access to personal data held about them. ISS will respond to such requests within the statutory timeframe.

Individuals also have the right to request correction, deletion, restriction, or transfer of their personal data where applicable.

ISS will ensure that:

• All staff handling personal data are aware of their      responsibilities;
• Training and supervision are provided as appropriate;
• Enquiries regarding data protection are handled promptly and      courteously; and
• Internal reviews and audits are carried out periodically to      maintain compliance.

Any breach of this policy or of data protection law by employees may result in disciplinary action.

8. Policy Review and Contact

This policy will be reviewed regularly to ensure it reflects current legal requirements and best practice in data management and cybersecurity.

For questions, requests, or concerns relating to data protection, please contact:

Geert Hindrik van Boven
Company Director and Data Controller
Intelligent Structural Solutions Ltd

Date: 28 September 2021 (last reviewed 30.10.2025)