Data Protection Policy

Lycia Limited is the data controller for personal data processed through its website, Staff Portal, Client Portal, secure verification links and associated services.

Lycia adheres to the seven principles of UK GDPR Article 5:

• Lawfulness, fairness and transparency — processing must have a valid lawful basis and be transparent to data subjects
• Purpose limitation — data is collected for specified, explicit purposes and not further processed incompatibly
• Data minimisation — only data adequate, relevant and limited to what is necessary is collected
• Accuracy — data is kept accurate and up to date; inaccurate data is rectified or erased
• Storage limitation — data is not kept longer than necessary (see Retention Schedule)
• Integrity and confidentiality — data is processed securely using appropriate technical and organisational measures
• Accountability — Lycia can demonstrate compliance with these principles

Before processing personal data, Lycia confirms the lawful basis under UK GDPR Article 6. Where special-category data is processed, an Article 9 condition is identified. Where criminal-offence data is processed, an Article 10 condition is identified. See the Privacy Policy for the processing purposes table.

Consent is only used where it is the genuine lawful basis — Lycia does not use consent where contract, legal obligation or legitimate interests is the real basis.

Lycia collects only the personal data necessary for the stated purpose. Forms and verification workflows are designed to request the minimum data required. Data obtained from third-party sources (e.g. Companies House) is not used for purposes beyond verification and due diligence.

Clients and data subjects can request rectification of inaccurate data through the data subject rights process.

Personal data is retained in accordance with the Data Retention Schedule. Retention periods are reviewed at least annually. Data is securely deleted or anonymised when no longer required, subject to legal hold requirements.

Lycia has a defined workflow for handling data subject requests (DSARs). See the Data Subject Rights page for the public process. Internally, DSARs are managed through the administration panel with identity verification, deadline tracking, system searches, exemptions assessment and audit trails.

Identity is verified before any data is disclosed. The standard deadline is one month, extendable by two months for complex requests.

DPIAs are conducted for high-risk processing activities, including Shufti biometric verification, AML/sanctions screening, automated matching, identity-document processing, secure client links, large-scale sensitive data processing, international transfers and AI document analysis.

See the administration panel for the DPIA register. DPIAs are not marked approved automatically — they require Privacy Lead and management review.

Lycia only engages processors under written data processing agreements. Processors are reviewed before engagement and periodically thereafter. The subprocessor register and DPA register are maintained in the administration panel.

International transfers are assessed and documented in the International Transfer Register. Appropriate transfer mechanisms (adequacy, IDTA, UK Addendum) are used where data leaves the UK.

Lycia applies privacy by design principles to new features and processing activities. A mandatory Privacy by Design Checklist must be completed for new features involving personal data. See the administration panel for the checklist template.

All staff receive data protection induction training and annual refreshers. Role-specific training is provided for handling identity documents, AML confidentiality, secure data-room use, incident reporting, phishing awareness and subject access requests. Training records are maintained in the administration panel.

Lycia conducts periodic internal audits of its data protection practices, including review of the ROPA, retention schedule, subprocessor register and security controls. Audit findings are tracked to remediation.

This policy is reviewed at least annually or following a significant change in processing activities.

Personal data breaches are handled in accordance with the Personal Data Breach Policy. The ICO is notified within 72 hours where a breach is likely to result in a risk to individuals. Individuals are notified where there is a high risk.

Staff who fail to comply with this policy may be subject to disciplinary action up to and including termination of employment. Serious breaches may also result in legal consequences.

This policy is reviewed at least annually by the Privacy Lead and approved by the Master Administrator. The review date and approval are recorded in the policy versioning system.

DRAFT — SOLICITOR AND DATA-PROTECTION REVIEW REQUIRED