Data Handling

At PIP Agency, the responsible and secure handling of personal data is fundamental to our operations. This page explains, in plain language, exactly how we process the data you entrust to us — from the moment of collection through to secure deletion.

We operate under a data minimisation principle: we collect only what is strictly necessary, store it only for as long as required, and protect it using industry-standard security controls throughout its lifecycle.

The personal data we process falls into the following categories, each collected for a specific and documented purpose:

We process personal data under the following lawful bases as defined under the UK GDPR. Each processing activity has a documented purpose and legal basis.

We implement a layered security architecture aligned with ISO/IEC 27001 principles and industry best practices. Our security programme covers technical infrastructure, operational procedures, and human factors.

Infrastructure Security

• All servers are hosted in SOC 2 Type II certified data centres within the UK and EEA
• Network perimeter protected by enterprise-grade firewall and intrusion detection systems
• Automated vulnerability scanning performed on a continuous basis
• Regular third-party penetration testing (minimum annually)
• DDoS protection and rate limiting on all public-facing endpoints
• Isolated network segments for different data sensitivity levels

Access Control

• Role-based access control (RBAC) — staff access only what they need for their role
• Multi-factor authentication (MFA) mandatory for all staff with system access
• Privileged access management (PAM) for administrative functions
• All access is logged, monitored, and subject to audit
• Access rights reviewed quarterly and upon any change in role
• Immediate access revocation upon staff departure

Operational Security

• All staff complete mandatory data protection and security awareness training
• Confidentiality agreements required for all personnel and contractors
• Security incident response plan maintained and tested
• Business continuity and disaster recovery plans in place
• Regular security reviews of third-party service providers

We use strong, industry-standard encryption to protect your data both in transit and at rest. Our encryption practices are reviewed regularly to ensure they remain current with best practices.

Data in Transit

Data at Rest

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, and to comply with our legal and regulatory obligations. Once data is no longer required, it is securely deleted using methods appropriate to the sensitivity of the information.

Retention Schedule

Secure Deletion Methods

• Database records are cryptographically overwritten and logically deleted
• File system data is securely erased using NIST 800-88 compliant methods
• Physical media is destroyed using certified providers when decommissioned
• Backup copies are deleted in line with their own scheduled purge cycle
• Deletion is logged and auditable to confirm completion

Under the UK GDPR and EU GDPR, you have the following enforceable rights in respect of your personal data. PIP Agency is committed to honouring these rights promptly and without charge in the vast majority of cases.

Despite our robust security measures, no system is entirely immune to incidents. We have a documented and tested incident response plan that ensures any personal data breach is handled promptly, transparently, and in compliance with our legal obligations.

Detection and Assessment

• Automated monitoring systems are in place to detect anomalous activity 24/7
• Any suspected security incident is escalated to our security team immediately
• The nature, scope, and likely impact of the incident are assessed without delay
• Affected data categories and individuals are identified as quickly as possible

Regulatory Notification

Where a data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with Article 33 of the UK GDPR. Our notification will include:

• The nature of the breach, including categories and approximate number of individuals affected
• The name and contact details of our Data Protection contact
• The likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects

Individual Notification

If a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay. Our notification will describe what happened, what data was affected, the potential consequences, and what steps we are taking — as well as guidance on steps you can take to protect yourself.

We engage a small number of carefully vetted third-party processors to help us operate our platform. All processors are bound by Data Processing Agreements (DPAs) that require them to process data only on our instructions and to maintain appropriate security standards.

We review our third-party processors annually and following any material changes to their services or security practices. We will update this page if we engage new processors who handle personal data in a materially different way.

We endeavour to keep all personal data within the United Kingdom and the European Economic Area. In the rare cases where a transfer outside these territories is necessary, we ensure appropriate safeguards are in place:

• Adequacy decisions: transfers to countries recognised as providing adequate data protection by the UK ICO or European Commission
• Standard Contractual Clauses (SCCs): legally binding contractual commitments by the recipient to protect your data to UK/EU standards
• Binding Corporate Rules: where applicable for transfers within a corporate group
• Supplementary technical measures: additional encryption or pseudonymisation for all international transfers