1. Introduction: This policy sets out how Debbie Sedgwick Celebrant (the "Owner"), registered with ICO No. XXXXXXXXXX, complies with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The Owner is committed to protecting the personal data of all individuals. This policy explains how personal data is collected, used, stored, and protected.

2. Data Controller: The Data Controller is the Owner. The Owner is responsible for ensuring compliance with data protection legislation.

3. Data Collected: The Owner may collect and process the following categories of personal data:

Enquiry Information: Names, addresses, phone numbers, and email addresses of individuals or organisations making enquiries.
Supplier Information: Names and contact details of suppliers, including records of meetings.
Financial Records: Bank details (if required for payments), invoices, and receipts.
Correspondence: Emails, letters, or phone call records relating to bookings or celebrant services.

4. Legal Basis for Processing: The Owner processes personal data under the following lawful bases:

Contract: To manage all celebrant services.
Legal Obligation: To comply with charity law, financial reporting, and regulatory requirements.
Consent: For optional communications such as newsletters or promotional materials.

5. How Data Is Used: Personal data is used only for the purposes for which it was collected to:

Manage all celebrant services.
Maintain records of meetings.
Comply with any legal obligations.
Communicate with clients, suppliers and any other individuals involved.

6. Data Sharing: The Owner will not sell or share personal data with third parties for marketing purposes. Data may be shared only when required by:

Regulatory authorities (e.g. HMRC).
Service providers (e.g., accountants, IT support) under a confidentiality agreement.
Law enforcement, where legally required.

7. Data Retention Booking records: Retained for up to 7 years for financial and legal purposes.

Client/Suppler records and notes: Retained permanently.
Correspondence: Retained for up to 2 years, unless required longer for legal reasons.

8. Data Security: The Owner takes appropriate technical and organisational measures to keep personal data secure:

Paper Records stored in locked cabinets.
Electronic Data protected by password-protected devices and / or secure cloud storage.
Personal Data access limited to the Owner.

9. Data Subject Rights: Under GDPR individuals have the following rights:

Access to Their Personal Data.
Rectification of Inaccurate Data.
Erasure (where applicable).
Restrict or Object to processing.
Data Portability (where applicable).

Requests should be made in writing to the Owner, who will respond within one month.

10. Breach Procedure: Any personal data breach (loss, theft, or unauthorised access) must be reported immediately to the Owner. Serious breaches will be reported to the Information Commissioner’s Office (ICO) within 72 hours.

11. Review: This policy will be reviewed annually by the Owner or sooner if legislation changes.

12. Contact: For any questions regarding this policy or personal data, please contact the Owner.