Data Protection & UK GDPR Policy
AVINOK SOLUTIONS LTD
Company number: 17376239. Company type: Private Limited by Shares.
Version 1.2 — approved by the company owner on 21 October 2026. Effective date: 21 October 2026.
1. Purpose and scope
This policy provides a framework for protecting personal data in Avinok's consulting, ERP, aviation MRO, software engineering and operational activities. It applies to directors, staff, contractors and suppliers handling personal data on Avinok's behalf, whether in electronic records, paper files, email or client systems.
The applicable framework includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant amendments in force, including applicable changes under the Data (Use and Access) Act 2025. Electronic marketing and cookies also require consideration of the Privacy and Electronic Communications Regulations (PECR). Legal requirements take precedence over this policy.
2. Controller and processor responsibilities
Avinok is normally a controller when deciding how to use its own business-contact and enquiry data. Where it processes personal data only on a client's documented instructions, its role may be that of processor. The role must be assessed for each engagement rather than assumed from a job title or contract label.
Before processor work begins, an appropriate written data processing agreement must cover instructions, confidentiality, security, subprocessors, rights assistance, breach reporting, audit arrangements and return or deletion of data. A processor must notify its controller without undue delay after becoming aware of a personal data breach.
3. Data protection principles
- Lawfulness, fairness and transparency: identify a lawful basis and explain processing in clear privacy information.
- Purpose limitation: collect data for specified purposes and assess any proposed new use.
- Data minimisation: use only the personal data reasonably necessary for the task.
- Accuracy: take reasonable steps to correct inaccurate or outdated records.
- Storage limitation: keep identifiable data only as long as justified by documented retention criteria.
- Integrity and confidentiality: apply proportionate technical and organisational safeguards.
- Accountability: maintain evidence of decisions, assessments and compliance measures.
4. Lawful basis and higher-risk data
A lawful basis must be documented before processing begins. Depending on the activity, this may be contract, legal obligation, legitimate interests or valid consent. Legitimate interests require a necessity and balancing assessment; consent must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.
Special category data requires both an Article 6 basis and an appropriate Article 9 condition, with any additional Data Protection Act safeguards. Criminal offence data requires the relevant Article 10 authority or legal condition. Staff must not collect either category simply because it is available in a client system.
5. Governance and accountability
| Role | Required responsibility |
|---|---|
| Management / policy owner | Maintain and review this policy, assign resources, review risks and maintain processing records where required. |
| Privacy contact | Coordinate requests, complaints, supplier checks, assessments and incident escalation through info@avinok.co.uk. |
| Staff and contractors | Follow authorised instructions, complete appropriate training and promptly report suspected loss, misuse or unauthorised access. |
| Project and supplier owners | Assess data access, contracts, security, retention and transfers before introducing systems or providers. |
Management must assess whether a statutory Data Protection Officer or overseas representative is required. The privacy contact above is not a claim that a DPO has been appointed.
6. Security, suppliers and international transfers
Controls must be selected according to risk and may include least-privilege access, multi-factor authentication, encryption, secure configuration, patching, backups, restoration testing, access reviews and secure disposal. This is a required control framework, not a claim that every control is already implemented.
Suppliers must be assessed before receiving personal data. Restricted international transfers must use an applicable UK adequacy arrangement or other lawful safeguard, such as the UK International Data Transfer Agreement or UK Addendum where appropriate, together with required transfer assessments. Actual providers, destinations and safeguards must be recorded and reflected in relevant privacy notices.
7. Individual rights and complaints
Requests should be sent to info@avinok.co.uk and logged promptly. Rights may include access, rectification, erasure, restriction, portability, objection and withdrawal of consent, subject to the conditions and exemptions that apply. Identity checks must be proportionate, and only necessary verification information should be requested.
Responses must meet the applicable statutory time limit, normally one month. Any lawful extension, clarification, refusal or fee must be justified and explained as required by law. Complaints must be acknowledged, investigated fairly and answered without undue delay, within applicable legal time limits. Individuals may also complain to the Information Commissioner's Office (ICO).
8. Personal data breaches
Anyone discovering a suspected breach must report it immediately through the privacy contact without waiting to establish all facts. The response must contain the incident, preserve relevant evidence, assess risk, record decisions and take remedial action.
Where a breach is notifiable to the ICO, notification must be made without undue delay and, where feasible, within 72 hours of awareness; reasons for delay must be provided. Affected individuals must be informed without undue delay when a breach is likely to result in a high risk to their rights and freedoms, unless a lawful exception applies. All breaches, including those not notified, must be documented.
9. Retention, privacy by design and AI
Each processing activity must have an approved retention period or clear criteria based on purpose, legal obligations and claims risk. Records must be securely deleted or anonymised when no longer needed, with backup expiry and legal holds addressed.
Projects must consider privacy at design stage. A data protection impact assessment must be completed before processing likely to create high risk. Personal or confidential client data must not be entered into AI tools without authorisation, an assessed lawful basis, supplier safeguards and any required client agreement. Significant automated decision-making must be assessed against applicable legal requirements and safeguards before use.
10. Review and related notices
Review this policy at least annually and after significant legal, operational or security changes. The Privacy Policy explains how personal data is handled; the Cookie Policy describes website technologies. Questions about this policy should be sent to info@avinok.co.uk.
Reference: ICO UK GDPR guidance and resources.