Capitan Systems Limited
Best viewed on a device with a larger screen...
Version 2.0 — November 2026
This policy sets out how Capitan Systems Limited manages its data protection responsibilities. It applies to anyone authorised to handle personal information on Capitan’s behalf, including directors, employees and contractors where applicable.
It should be read alongside our Privacy Notice, Security Statement, Data Processing Agreement and relevant internal procedures.
We must comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection and electronic communications legislation, as amended.
Personal information must be:
We are responsible for demonstrating compliance, not simply stating that these principles apply.
Capitan’s management is responsible for assigning ownership of data protection activities and ensuring that appropriate resources and procedures are in place.
Anyone handling personal information must understand the requirements relevant to their work, follow authorised instructions and promptly report concerns.
A formal Data Protection Officer will be appointed where required by law. Assigning responsibility for privacy matters does not, by itself, constitute appointment to that statutory role.
Privacy enquiries may be directed to enquiries@i-capitan.com.
Capitan acts as controller where it determines the purposes and essential means of processing, including its own customer administration, billing and business correspondence.
Capitan ordinarily acts as processor when hosting or handling personal information on a customer’s documented instructions. That processing must be covered by an appropriate Data Processing Agreement.
Information obtained through processor activities must not be reused for Capitan’s independent purposes without a separate lawful justification and appropriate transparency.
Before collecting or using personal information as controller, we must identify and document an appropriate lawful basis and provide the required privacy information.
Consent is not required for every processing activity. Depending on the circumstances, processing may instead be necessary for a contract, compliance with a legal obligation or a legitimate interest.
Where legitimate interests are relied upon, we must assess the purpose, necessity and impact on individuals, including their reasonable expectations and rights.
Where consent is required, it must meet the applicable legal standard and be capable of withdrawal. Consent must not be inferred merely from browsing a website or reading a privacy notice.
A new purpose must be assessed before information is reused, and relevant privacy information must be updated where required.
Only information reasonably necessary for an identified purpose should be collected.
Forms, imports and integrations must not request or retain unnecessary personal information. Access and processing should be limited to the agreed scope.
Reasonable steps must be taken to correct inaccurate information. Disputed accuracy should be recorded and investigated where relevant.
Processing special-category information requires both an appropriate lawful basis and a separate condition permitting that processing. Criminal-offence information is subject to additional requirements.
Processing involving sensitive information, children, systematic monitoring or other potentially high-risk activities must be assessed before it begins.
Where required, a data protection impact assessment must identify the risks, safeguards and any need for consultation with the regulator.
Customer instructions involving such activities must be reviewed against the agreed service scope and Data Processing Agreement before acceptance.
Data protection must be considered when designing or changing services, forms, permissions, integrations and operational processes.
Settings should limit collection, access, disclosure and retention to what is necessary for the intended purpose. Privacy controls should be clear and usable.
New suppliers or significant changes to processing must be assessed before implementation.
Personal information must be handled in accordance with the Security Statement and applicable internal procedures.
Authorised people must:
Personal information must not be copied to an unapproved device, storage location or service.
Access to customer information for support or maintenance must be necessary, authorised and consistent with the customer’s documented instructions.
Capitan does not sell personal information or disclose it for another organisation’s independent marketing.
Operational providers must be assessed according to the information and services involved. Where they act as processors, appropriate written contractual protections must be established before processing begins.
Providers acting as independent controllers must be identified and their role explained where required.
Subprocessors handling customer information must be managed under the authorisation, notification and other requirements of the applicable Data Processing Agreement.
A UK hosting location does not remove the need to assess other processing locations, including remote access, communications and cloud backups.
Restricted international transfers must be identified before they begin and supported by an applicable lawful mechanism, including any required assessment and supplementary measures.
Relevant providers, locations and safeguards must be recorded and reflected in the appropriate privacy and contractual documentation.
Retention periods or clear retention criteria must be established for the categories of information Capitan controls. Information must not be retained indefinitely merely because it may be useful.
Legal recordkeeping obligations, active disputes and other justified requirements must be taken into account.
Information processed for customers must be retained, returned or deleted in accordance with their lawful instructions and the Data Processing Agreement.
Protected backup copies must follow a documented retention cycle. Where a backup is restored, relevant deletion and restriction instructions must be reapplied before ordinary processing resumes.
Requests concerning access, correction, deletion, restriction, objection, portability or withdrawal of consent must be recognised and passed promptly to the person responsible for handling them.
Requests do not need to use a particular form or legal terminology. Identity checks must be proportionate to the circumstances.
We must respond within the applicable legal timescale and explain any lawful extension, restriction, fee or refusal.
Where a request concerns information processed for a customer, we must inform that customer promptly and assist under the Data Processing Agreement rather than independently deciding how the request should be fulfilled.
Suspected loss, unauthorised access, disclosure, alteration or destruction of personal information must be reported internally immediately.
We must investigate promptly, take appropriate containment action and record the facts, effects and remedial measures.
Where Capitan acts as processor, the affected controller must be notified without undue delay after we become aware of a personal data breach, in accordance with the DPA.
Where Capitan acts as controller, we must assess whether notification to the ICO is required. A notifiable breach must be reported without undue delay and, where feasible, within 72 hours of awareness. Any delay must be explained.
Where a breach is likely to result in a high risk to individuals, we must also assess and meet the requirement to inform them without undue delay, subject to applicable exceptions.
We must not postpone a required initial notification merely because an investigation is incomplete.
Marketing activity must comply with applicable data protection and electronic communications rules. Required permissions must be obtained and opt-outs honoured.
Information supplied for an enquiry must not automatically be treated as consent to marketing.
Cookies and similar technologies must be assessed by purpose. Where consent is required, they must not be used before that consent is obtained. Any legal exception must meet its applicable conditions.
We must maintain records appropriate to our activities and legal obligations, including relevant processing purposes, lawful bases, providers, transfers, retention decisions, requests, incidents and risk assessments.
Anyone authorised to process personal information must receive instructions or training proportionate to their responsibilities.
This policy will be reviewed when material changes in law, processing, suppliers or identified risks require it. Material changes must be communicated to affected authorised personnel.
This policy does not replace the specific commitments in a customer’s Data Processing Agreement or remove rights under applicable law.
bespoke website build, Capitan, CRM, e-marketing, e-billing, analytics, website, London, Kensington, Bayswater