Contact US

Data Protection Policy

This policy sets out how City Stone London complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Scope

This policy applies to all personal data processed by CITY STONE LTD (Company No. 09582312), including data held electronically, on paper or in other formats. It applies to all workers, contractors and trainees who process personal data on our behalf.

Principles

We follow the data protection principles: lawfulness, fairness & transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity & confidentiality; and accountability.

Roles

  • Data Controller: CITY STONE LTD
  • Lead for data protection: Practice Manager (or delegate)
  • All staff must complete training and follow this policy and related procedures.

Lawful bases & special category data

We identify and document a lawful basis for each processing activity (Contract, Legal Obligation, Legitimate Interests, Consent, etc.).

Individual rights

  • We have procedures to respond to requests for access, rectification, erasure, restriction, portability and objection within one month.
  • No fee is charged unless a request is manifestly unfounded or excessive.

Data minimisation & retention

We collect only what is necessary and keep it no longer than needed. Retention schedules: enquiry data up to 24 months; finance 6 years; operational records per legal and business needs. Secure disposal/anonymisation is applied at end of retention.

Security

  • Access controls, encryption in transit, secure configurations and patching.
  • Backups and tested restore procedures.
  • Processor due diligence and data processing agreements.
  • Confidentiality obligations for staff and contractors.

Sharing & international transfers

We only share data with recipients who have a lawful need and appropriate safeguards. International transfers outside the UK use adequacy regulations or appropriate safeguards (e.g., UK IDTA/Addendum, SCCs).

Data breaches

We maintain an incident response process. Personal data breaches are assessed and, where required, reported to the ICO within 72 hours and to affected individuals without undue delay.

Training & review

All staff receive regular data protection training. We periodically audit compliance and review this policy annually or after significant changes.

Contact

Questions about this policy: info@citystone.london or write to Unit 5, Sandiford Rd, Sutton, SM3 9RN. Date: 2026-05-05.