Approved by Raymond Cullen, Managing Director — next review January 2027

Data Protection & Cyber Security Policy

How Cullen Utilities Ltd protects personal data and IT systems, in line with the Data Protection Act 2018 and UK GDPR.

Cyber security

We protect restricted, confidential and sensitive data from loss, to avoid reputational damage and to avoid adversely affecting our clients, while keeping the flexibility to access data and work effectively. If you believe you have been subject to a breach, report it to the company Data Protection Officer as soon as possible at ray@cullenutilities.co.uk, with enough information for them to respond appropriately.

Personal data

Personal data, as defined by the Data Protection Act 2018, is data relating to a living individual who can be identified from it. In accordance with the Act, Cullen Utilities Ltd ensures that personal data is:

  • Processed fairly and lawfully.
  • Obtained only for specified and lawful purposes and not processed in any incompatible manner.
  • Adequate, relevant and not excessive for the purposes for which it is processed.
  • Accurate and, where appropriate, kept up to date.
  • Kept no longer than is necessary.
  • Processed in accordance with the rights of data subjects under the Act.
  • Protected against unauthorised or unlawful processing, accidental loss, destruction or damage through appropriate technical and organisational measures.
  • Kept secure against transfer outside the European Economic Area unless an adequate level of protection exists.

Your rights

We are committed to ensuring that data subjects can access a copy of their personal data by means of a subject access request; object to processing likely to cause damage or distress; prevent processing for direct marketing; object to decisions taken by automated means; have inaccurate data rectified, blocked, erased or destroyed; and claim compensation for damage caused by a breach of the Act.

How we handle data

We comply with all aspects of the UK GDPR. Our people, agents and contractors follow strict handling rules, including: encrypting emails and files that contain data; transmitting data only over secure, firewalled networks; never sharing personal data informally; never leaving data unattended or on view; locking screens when devices are left; securely disposing of unwanted copies; not storing personal data on mobile devices; and backing up and encrypting stored data. Company devices use firewalls, virus scanning and passwords that are strong, changed regularly and never written down or shared. Staff are trained on these procedures at induction and at least annually.

Accountability

Cullen Utilities Ltd has appointed Raymond Cullen as Data Protection Officer, with responsibility for overseeing data protection and ensuring compliance with this policy and the Data Protection Act 2018. Only those who need access to personal data to do their job have it, and everyone handling personal data is trained, supervised and bound by contract to follow the Act and this policy.

Subject access requests

Anyone whose personal data we hold may make a subject access request at any time. Requests should be made in writing to the company director, clearly identified as a subject access request, with proof of identity. We acknowledge requests within 10 working days and respond fully within a maximum of 40 calendar days, confirming what data we hold, how it is used and who it is shared with.

ICO notification

As a data controller, Cullen Utilities Ltd notifies the Information Commissioner's Office that it processes personal data, renews that notification annually, and notifies any changes within 28 days. The Data Protection Officer is responsible for keeping the registration up to date.