Data Protection Policy

Clouds Nest Solutions Ltd · Published 1 October 2026

Purpose and scope

This policy sets expectations for Clouds Nest Solutions Ltd personnel, contractors and suppliers handling personal information in software development, support, sales and business operations. It supports compliance with applicable UK data protection law.

Core principles

• Use information lawfully, fairly and transparently for a clear purpose.
• Collect the minimum information needed and correct inaccurate records.
• Set appropriate retention periods and securely dispose of information when no longer needed.
• Protect confidentiality, integrity and availability, and keep records of significant decisions.

Controller and processor roles

For our own enquiries, business relationships and employment records, Clouds Nest determines the relevant purposes of processing. For customer campaign data, our role and instructions must be defined in the applicable agreement. A customer remains responsible for its lawful bases, notices and campaign practices. Personnel must not reuse campaign information for unrelated purposes.

Access and security

Information must be accessible only to authorised people who need it. Personnel must use approved systems, protect credentials, follow access controls, avoid copying production data into personal accounts and report lost devices or suspicious access promptly. Support and development work should use minimised or anonymised test information wherever practical.

Suppliers, requests and review

Before sharing information, check necessity, confidentiality obligations and appropriate contractual protections. Transfers outside the UK or EEA must use any safeguards required by applicable law. Refer rights requests to the responsible person promptly and follow the Subject Access and Personal Data Breach policies. Management is responsible for reviewing this policy when systems, suppliers or legal requirements change.