Privacy Policy

Last Modified: 4 August 2026

Westbrook Data Protection Services Limited (“WDPS”, “we”, “us” or “our”) is a UK-based data protection and privacy consultancy. We are a limited company registered in England and Wales under Company Registration Number 09518843. We are also registered with the Information Commissioner’s Office: ICO Registration Number: ZB099496

This policy applies to your use of our website and your interactions with Westbrook Data Protection Services Limited. If you follow a link to another website, that organisation will process your personal data in accordance with its own privacy information.

Westbrook Data Protection Services Limited is a registered trade mark. Trademark number: UK00004318810

Related Policies: For additional policies, please see our Terms and Conditions and our Cookie Policy

Who is responsible for your personal data?

UK data protection law distinguishes between a “controller” and a “processor”. For the personal data described in this privacy notice, Westbrook Data Protection Services Limited normally acts as the controller. Our company is a registered business in the United Kingdom. You can contact us at dpo@wdps.co.uk or at 2nd Floor, Midas House, 62 Goldsworth Road, Woking, GU21 6LQ with any questions about this policy or your personal data rights.

We are committed to respecting and protecting your privacy in line with UK data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and our founder is a registered solicitor with the Solicitors Regulation Authority in England and Wales as well as a member of IAPP.

Our data protection officer

Westbrook Data Protection Services Limited
2nd Floor, Midas House
62 Goldsworth Road
Woking, GU21 6LQ
Tel: +44 (0)7976 939 016
Email: dpo@wdps.co.uk

Our DPO is a qualified legal advisor with significant experience in UK data protection compliance. WDPS is registered with the Information Commissioner’s Office under registration number ZB099496.

Your privacy rights

As a data subject you have the following rights in respect of the personal data we hold on you.

• You have the right to ask for a copy of the personal data we hold about you and to learn how we use it (this is often called a “Data Subject Access Request” or DSAR). We normally have one-month to respond. Under the Data (Use & Access) Act 2025, if we need to ask you for more information to confirm your identity or to narrow down exactly what data you need, we may “stop the clock” on this one-month deadline. We will restart the countdown as soon as we have what we need from you. This helps us ensure we get you the right information as quickly and securely as possible. You can find our form here.
• Correction of inaccurate or incomplete data: If any of your personal data is inaccurate or incomplete, you have the right to have it corrected or updated without undue delay. You can also request that we complete any data that is incomplete.
• Request erasure: You can ask us to delete or remove your personal data in certain circumstances. This right, also known as “the right to be forgotten,” applies, for example, if the data is no longer necessary for the purposes it was collected, you withdraw consent (and no other legal basis for processing exists), or if the data has been unlawfully processed.
• Restrict processing: You have the right to request that we suspend or limit the processing of your personal data in specific situations. For instance, if you contest the accuracy of your data, you can ask us to restrict processing while we verify the information. Or if you object to our processing based on legitimate interests, you may request restriction pending the verification of whose interests prevail.
• Data portability: For data you have provided to us, which we process by automated means on the basis of your consent or for performance of a contract, you have the right to request a copy in a structured, commonly used, machine-readable format (e.g. CSV file), and you have the right to have that data transmitted to another controller where technically feasible. In plain terms, this allows you to take your data to another service.
• Object to processing based on our legitimate interest: You have the right to object to our processing of your personal data when it is based on legitimate interests or performed for direct marketing.
• Other rights. You have the right to lodge a complaint with the Information Commissioner’s Office if you are unhappy with how we have handled your data. Their details are: Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF. You can contact them on 0303 123 1113
• Direct marketing: You can object at any time to processing of your personal data for direct marketing purposes, and if you do, we will stop processing your data for that purpose immediately. (If you object to marketing emails, it’s effectively the same as unsubscribing, which you can do easily as noted above.)
• Legitimate interests: You may object if you believe our legitimate interest processing negatively impacts your rights, and we will reconsider the balance or cease processing unless we have a compelling reason that overrides your objection.
• Rights related to automated decision-making: If we ever use automated decision-making or profiling that produces legal effects or similarly significant effects for you, you have the right to not be subject to such decisions without human intervention. You also have the right to express your point of view and contest the decision. (Note: Our current services do not involve decisions made solely by algorithms that have significant effects on individuals. Should this change, we will update this policy and ensure appropriate safeguards as required by law).
• Right to withdraw consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal. For example, you can withdraw your consent to marketing emails by unsubscribing, or to cookie usage by updating your cookie settings. Once consent is withdrawn, we will stop the related processing activities.
• Right to lodge a complaint: If you believe we have infringed your data protection rights or not handled your personal data properly, you have the right to file a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. You can contact the ICO via their website or helpline. We would, however, appreciate the chance to address your concerns before you approach the ICO, so please consider reaching out to us first.

You can exercise your rights at any time by contacting us (see contact us below). We will respond to requests as soon as possible and no later than one month. There is normally no fee for exercising your rights; however, if a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to comply.

What personal data we collect

We collect personal information from you when you use our services. This may be through the use of our website in which case we use cookies, Google Analytics, CookieYes, newsletter tools, Google Tag Manager and contact-forms. You can find out how we collect your data in our cookie policy here.

If you engage in our signing service we may collect.

• Name
• Email address
• Company name
• Phone number
• Content of your message
• Photo ID
• Passport details

We use this information to respond to your enquiry and for the purpose of verification.
If you choose to become a client, we may collect information to advise you and carry out the work you commission us to do. This will include:

• Name
• Email address
• Passport details
• Photo ID
• Company name
• Phone number
• Content of your message
• Any documents you provide to us

Legal basis for processing

If you contact us, your personal data is processed:

• On the basis of legitimate interests – to provide you with a reply and handle your enquiry or for the purpose of verification and to carry out the work you commission us to do.

We do not process personal data for marketing unless you have opted in to receive communications.

How we use your personal information and our lawful bases

We use your personal information for the following purposes:

Responding to enquiries and preparing quotations

Where you contact us about services for yourself, we may process your personal information because it is necessary to take steps at your request before entering into a contract.

Where you contact us on behalf of an organisation, or where your enquiry does not relate to a potential contract with you personally, we may rely on our legitimate interests in responding to enquiries, providing information about our services and managing our business relationships.

Providing commissioned services

Where you enter into a contract with us personally, we process the personal information necessary to provide the agreed services and administer the contract.

Where our client is an organisation, we may process the personal information of its employees, representatives, clients or other relevant individuals where this is necessary for our legitimate interests, or those of our client, in delivering the commissioned services.

Verifying identity

We may verify your identity where this is necessary to respond securely to a request, provide our services, prevent fraud or unauthorised disclosure, or comply with a legal obligation.

Depending on the circumstances, we may rely on contractual necessity, compliance with a legal obligation or our legitimate interests in protecting personal information and ensuring that we are dealing with the correct person.

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights, interests and freedoms.

Where and how your data is stored

Our website is hosted by Catalyst2. While we do not actively collect or store personal data on our site, our web host may automatically log anonymous technical information (such as your IP address) for security and maintenance purposes. All data is stored on secure UK-based servers and is protected by industry-standard security measures including firewalls and 24/7 monitoring. For more details, please see the Catalyst2 Privacy Policy for more details.

Retention periods

Where we need to retain a physical copy of an identity document, we store it securely in a locked cabinet at our premises for 12 months. This is for our own legal purposes including accounting and is only accessed by the director of the company.

• Data Subject Access Requests (DSARs): When we manage a DSAR on your behalf, we retain your data until the process is complete. We will then securely delete and destroy it within 3 months.
• Other Services: If you engage with any of our other services, we will retain your data for 3 years.
• Financial Records: Any financial data provided through transactions will be retained for 6 years to comply with statutory legal requirements. After this period, it will be securely destroyed.

Who we share your data with

We do not sell, rent, or trade your personal data. We only share your information with trusted third parties necessary to deliver our services, run our business, and comply with legal obligations. This includes:

• Professional Advisors: Legal consultants, auditors, and insurers providing professional advice.
• Service Providers: Cloud storage hosts, IT support partners, and email marketing platforms operating under strict data processing agreements.
• Regulatory Bodies: Government entities, courts, or law enforcement agencies where we are legally compelled to do so.

All third-party service providers are required to take appropriate security measures to protect your personal data in line with our strict confidentiality policies.

Marketing and advertising

If you have signed up for marketing with us we only use your personal information to send you email marketing. You will be given a clear opportunity to unsubscribe in every marketing email.

Children’s privacy

Our website and services are not directed at children, and we do not knowingly collect personal data from children through the website.

External links

Our website may contain links to other websites. We are not responsible for the content or privacy practices of these third-party sites.

Changes to this privacy policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting the updated Privacy Policy on our website. Material changes may be communicated where appropriate.

How to complain

If you have concerns about how we handle your data, please contact us directly at dpo@wdps.co.uk
If you’re not satisfied with our response, you may lodge a complaint with the Information Commissioner’s Office:

ICO contact details:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: https://ico.org.uk
Helpline: 0303 123 1113

Contact us

We review this privacy policy regularly and update it as needed to reflect changes in our practices or legal obligations. The current version was last updated on 12 June 2026.