Data Protection Policy.

Effective Date: 10 December 2025

Atura Group Limited is committed to handling personal data lawfully, fairly, transparently and securely. This policy sets the rules and responsibilities that apply whenever Atura processes personal data in its own operations or on behalf of a customer. It applies equally to Atura’s account-managed customer services and its Print Portals and managed ordering services.

Purpose and legal framework

This policy supports compliance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), in each case as amended, including by the Data (Use and Access) Act 2025 (“DUAA”), and other applicable data protection law. It should be read with Atura’s Privacy and Cookie Policy, Information Security Policy, retention schedule, incident response procedure, customer contracts, data processing agreements and contract-specific security requirements.

This policy does not by itself create the contract required where Atura processes personal data for a customer. The relevant contract or data processing agreement must define the processing and the responsibilities of each party.

Scope and service routes

This policy applies to personal data handled by Atura in any format. This includes information about customers, supplier contacts, portal users, approvers, delivery recipients, employees, applicants and other individuals connected with Atura’s services.

Atura delivers its customer-facing work through two core service routes:

• Atura customer services and account-managed orders: print, merchandise, clothing, workwear, signage and related services ordered through account managers, business email, telephone or the Atura website.
• Print Portals and managed ordering services: customer-specific portals through which authorised users access products, submit and approve orders, upload or generate artwork, and provide fulfilment and delivery information.

The same data protection principles and core controls apply across both routes. The information collected, Atura’s legal role and the systems used will depend on the particular service and customer instructions.

This policy covers information held in websites, ordering portals, business email, approved working files, devices, hosted databases, Clarity, accounting systems, supplier communications, courier systems, backups, logs and paper records. It also applies to information processed by another organisation for Atura or by a subprocessor used to deliver services for an Atura customer.

Controller and processor roles

Atura acts as a controller when it decides why and how personal data will be used for its own activities. These activities include enquiries, account-managed and direct customer orders, customer and supplier relationships, accounts, direct marketing, website administration, security, recruitment, employment, legal compliance and management of Atura’s business.

Atura will normally act as a processor when a business or public-sector customer determines the purpose of a Print Portal or managed service, identifies the users or recipients, determines the information to be collected and instructs Atura to process that information. Atura may also act as processor where a customer supplies employee, personalisation or delivery information solely for Atura to fulfil an account-managed order on the customer’s instructions. In either case, Atura will act only on the customer’s documented lawful instructions, except where the law requires otherwise.

Atura may be a processor for one part of a relationship and a controller for another. For example, it may process portal-user, employee-recipient, personalisation and delivery data for a customer while acting as controller for its own invoicing, fraud prevention, security, legal claims and business contact records. The role must be assessed and recorded for each processing activity. Contract labels do not override the parties’ actual decisions and responsibilities.

Atura customer services and account managed orders

Atura provides print, merchandise, clothing, workwear, signage and related services through account managers, business email, telephone and the Atura website. Depending on the enquiry, quotation or order, Atura may process:

• customer and business contact names, job titles and organisations
• business or personal email addresses and telephone numbers
• billing addresses, business or home delivery addresses and delivery instructions
• enquiries, quotations, orders, invoices, transaction references and order history
• specifications, sizes, quantities, artwork, logos, photographs and personalisation content
• production, fulfilment, installation, dispatch and tracking information
• approvals, support messages, complaints and other customer communications

Information required to administer these services is principally recorded and managed in Clarity. Personal data may also be contained temporarily in business email, approved working files, system logs and backups. The minimum information necessary may be disclosed to the selected printer, manufacturer, decorator, installer, fulfilment provider, courier or other provider involved in completing the service.

For direct customer relationships, Atura will generally act as controller for customer accounts, enquiries, orders, invoicing and business administration. Where a customer supplies information about its employees, users or delivery recipients solely so that Atura can fulfil the customer’s instructions, Atura may act as processor for that information. The role will be assessed for each service and reflected in the relevant contract where required.

Print Portals and managed ordering services

Print Portals allows authorised users to access products, submit and approve orders, upload or generate artwork, arrange fulfilment and provide delivery information. Depending on the customer’s configuration and instructions, the service may process:

• names, job titles, organisations, usernames and portal roles
• business or personal email addresses and telephone numbers
• business, personal or home delivery addresses and delivery instructions
• cost centres, budgets, approver relationships and purchasing permissions
• order history, products, quantities, sizes and transaction references
• artwork, logos, photographs, names and other personalisation content supplied for production
• enquiries, support messages, approvals, complaints and other communications
• IP addresses, device information, sign-in activity, security events and audit information

Portal account, order, delivery, artwork and security information is stored in Atura’s WordPress and WooCommerce environment hosted using 20i infrastructure. Quotations, customer records, orders, production administration, invoicing, dispatch and tracking information are managed in Clarity. Temporary copies may also exist in business email, approved working files, system logs and backups.

Access to portal information is authenticated and limited according to the roles and permissions agreed with the customer. A personal or home address is not automatically special category data, but unauthorised disclosure could create significant risk. Access to delivery information must therefore be limited, and only the minimum information necessary may be provided to a production supplier, fulfilment provider or courier.

Special category and criminal offence data

Special category and criminal offence data require additional legal conditions and safeguards. Atura does not seek this information for ordinary account-managed orders, Print Portal orders or related fulfilment. Customers and users should not include unnecessary sensitive information in artwork, personalisation fields, delivery notes, emails or free-text fields.

Systems and processing stages

Atura maintains a data map and proportionate records of processing activities covering its account-managed customer services, Print Portals and the systems and organisations used to provide them. The principal processing stages are:

WordPress and WooCommerce are self-hosted software within Atura’s portal environment. Any external plugin, payment, email, analytics, security, backup, content delivery or support service that receives personal data must be approved and recorded separately. Changes to systems, integrations or customer-order workflows must be assessed before deployment.

Data protection principles

• Lawfulness fairness and transparency: Personal data must be processed lawfully, fairly and in a way that individuals can understand.
• Purpose limitation: Information must be collected for specified purposes and not reused incompatibly.
• Data minimisation: Only information reasonably needed for the task may be collected, viewed, exported or shared.
• Accuracy: Reasonable steps must be taken to keep material information accurate and to correct or delete inaccurate information.
• Storage limitation: Personal data must not be kept longer than required by the applicable schedule, contract, instruction or legal obligation.
• Security: Personal data must be protected against unauthorised access, loss, alteration, disclosure, destruction and material unavailability.
• Accountability: Atura must be able to demonstrate compliance through contracts, records, assessments, training, monitoring and corrective action.

Lawful basis

Where Atura acts as controller, it will identify and document an appropriate lawful basis before processing begins. Depending on the activity, processing may be necessary for a contract, compliance with a legal obligation, Atura’s or another party’s legitimate interests, consent or protection of vital interests.

Where Atura acts as processor, the customer acting as controller is responsible for determining the lawful basis. Atura will record and follow the customer’s instructions and will not decide a new purpose or use the information for an unrelated Atura purpose without an independent lawful basis and the required privacy information.

Transparency and privacy information

When Atura acts as controller, it will provide clear privacy information covering its identity and contact details, categories and sources of personal data, purposes and lawful bases, recipients, retention, individual rights and the right to complain to the Information Commissioner’s Office.

When a Print Portals, managed-service, account-managed or other customer acts as controller, that customer is responsible for giving its users, employees and delivery recipients appropriate privacy information. Atura will provide reasonable information about the processing, systems, subprocessors and retention arrangements needed to prepare that notice. Atura’s Privacy and Cookie Policy explains processing for which Atura is controller and gives general information about its processor services.

Access and security

Atura will select and document technical and organisational measures according to the nature, volume and sensitivity of the information and the potential effect of a breach. Controls must be implemented in practice, evidenced where required and reviewed when systems, risks or services change.

• Access must follow business need and least privilege and must be removed promptly when no longer authorised.
• Administrative and privileged accounts must be individually assigned wherever technically possible.
• Multi-factor authentication must be enabled for administrative and privileged access to 20i, WordPress, Clarity, business email, backup services and other systems processing personal data. Where a system cannot support multi-factor authentication, the limitation, compensating controls, risk assessment and approval of the resulting risk must be documented.
• WordPress, WooCommerce, plugins, themes, server components and connected services must be supported, updated and monitored according to risk.
• Access to web-based systems, including Print Portals and Clarity, must use encrypted HTTPS/TLS connections.
• Personal data must be transferred through approved secure methods and sent only to verified recipients.
• Exports, downloads and local copies must be minimised, protected and securely deleted when no longer required.
• Personal data must not be entered into unapproved generative AI services, personal email accounts, consumer file-sharing services or unapproved removable media.
• Backups, recovery arrangements, security logging, malware protection and incident response must be proportionate to the importance of the service and tested at suitable intervals.
• Shared, default and dormant accounts must be avoided or controlled, and privileged access must be reviewed periodically.

Access and activity are logged to the extent supported by each system. Print Portals retains order, approval, sign-in and security information, while Clarity maintains quotation, order and transaction records across both service routes. Atura requires security logging, individual administrative accounts where technically possible and periodic review of privileged access.

Government contract information

Where Atura creates, receives, processes, stores or manages information under a government contract, Atura will comply with the security classification, handling instructions and contract-specific security requirements notified by the contracting authority. This includes requirements applying to information classified as OFFICIAL or carrying an additional handling marking.

Before government data is received, Atura will identify and document applicable requirements for access, authentication, hosting, international access, subprocessors, transmission, retention, return, deletion, incident notification, audit and personnel security. Relevant obligations must be passed to suppliers and subprocessors where their services form part of the contract.

Suppliers couriers and other recipients

Atura will disclose only the minimum personal data necessary for the recipient’s task. A production supplier should receive only the specification, artwork, personalisation and fulfilment details required for the relevant order. It must not receive an individual’s complete portal profile, complete Clarity record, unrelated customer records or previous order history. A courier should receive only the contact and delivery information needed to complete and manage the delivery.

Production suppliers, factories, fulfilment providers and couriers do not have direct access to Atura’s systems. They receive only the specific information supplied by Atura for the relevant order or service. Personnel working for hosting and software providers do not have routine operational access to customer data, although limited technical access may be possible where required for authorised support, maintenance, security, backup or recovery.

The legal role of each recipient will be assessed according to its actual activities. A supplier may act as a processor or subprocessor where it follows Atura’s or the customer’s instructions. A courier or other provider may act as an independent controller for some processing where it determines its own purposes or must meet its own legal obligations. Appropriate contract and privacy arrangements must reflect the role identified.

Processor and subprocessor controls

Where Atura acts as processor, the customer contract or data processing agreement must describe the subject matter and duration of the processing, its nature and purpose, the types of personal data, categories of individuals, processing instructions and the rights and duties of the customer.

The agreement must also address confidentiality, technical and organisational measures, subprocessors, assistance with individual rights, personal data breaches, impact assessments, deletion or return at the end of the service, records, information rights and audits. Contract-specific notification deadlines take precedence where they are shorter than the general periods in this policy.

Atura will maintain a current register of subprocessors used for customer data. Before appointing a subprocessor, Atura will:

• complete proportionate due diligence covering security, location, access, retention, resilience and breach arrangements
• obtain the customer’s specific or general written authorisation as required by the customer agreement
• give notice of material subprocessor changes where required and provide a reasonable opportunity to raise a legitimate objection
• impose appropriate data protection obligations, including confidentiality, security, instructions, assistance and deletion
• monitor material changes and address serious or persistent non-compliance

20i and Clarity must be recorded in the relevant system and subprocessor records where they process personal data for an Atura customer. Relevant production, fulfilment and technology providers must also be recorded. Courier roles must be recorded according to the applicable service and terms. Atura remains responsible for its subprocessors as required by the applicable contract and data protection law.

International access and transfers

Atura does not routinely initiate restricted transfers of personal data outside the UK. International processing may arise where 20i, Atura’s UK-based hosting provider, uses processing locations or subprocessors outside the UK, or where a customer order requires fulfilment or delivery outside the UK.

20i’s current Data Processing Agreement permits processing in the UK, EEA and other jurisdictions and onward transfers to subprocessors under applicable legal safeguards. Atura will keep 20i’s terms, subprocessors and safeguards under review and, where Atura acts as processor, comply with any applicable customer-authorisation requirements.

For international fulfilment or delivery, Atura will disclose only the information reasonably required, normally the recipient’s name, delivery address, relevant contact details, delivery instructions, order reference and information required for customs clearance.

Where Atura initiates a restricted transfer to a separate organisation outside the UK, it will identify the recipient, destination and legal role, follow applicable customer instructions and document the transfer mechanism. The transfer must be covered by UK adequacy regulations, appropriate safeguards such as the IDTA or UK Addendum together with any required transfer risk assessment/data protection test, or a valid UK GDPR exception. Only the minimum necessary personal data may be transferred.

Retention deletion and return

Atura may retain customer and order records, including contact details, quotations, order history, specifications, pricing, artwork, approvals, production, delivery and tracking information, to manage customer relationships, support genuine repeat ordering, meet accounting and tax obligations, resolve complaints and disputes, and establish, exercise or defend legal claims.

Where these records contain personal data, Atura will retain them only while the relevant purpose continues and can be justified. Retained personal data will be reviewed at least annually and deleted or anonymised when no longer required. Non-personal job specifications, artwork and commercial information may be retained for longer.

Accounting records, including relevant orders, invoices and delivery notes, will normally be retained for at least six years from the end of the relevant financial year, or longer where required by law, an investigation or a legal claim. Delivery addresses, contact details and personalisation content will be assessed separately and retained only while reasonably required.

Where Atura acts as processor, retention, return and deletion will follow the customer’s documented instructions and the applicable contract. Deletion requests will be actioned unless Atura is required or otherwise lawfully entitled to retain particular information, in which case the reason will be documented and explained.

Individual rights and complaints

Depending on the circumstances, individuals may have rights to be informed, access their personal data, correct inaccurate data, request erasure or restriction, receive portable data and object to processing. Where processing is based on consent, consent may be withdrawn at any time without affecting processing already carried out lawfully.

Where a significant decision is based solely on automated processing, individuals may have rights to receive information about the decision, make representations, obtain human intervention and contest the decision. All rights are subject to the applicable legal conditions and exemptions.

Individuals may complain directly to Atura if they believe their personal data has been handled unlawfully. Atura will facilitate complaints, acknowledge them within 30 days, make appropriate enquiries, keep the complainant informed and communicate the outcome without undue delay. Individuals may also complain to the Information Commissioner’s Office.

Any individual-rights request received by Atura must be forwarded immediately to the Data Protection Leads. Where Atura acts as controller, it will verify identity where reasonably necessary and respond without undue delay and normally within one month, subject to any extension permitted by law. For a subject access request, Atura will conduct reasonable and proportionate searches and will pause the response period for clarification only where clarification is reasonably required. Where Atura acts as processor, it will notify and assist the relevant customer and will not respond independently unless authorised or legally required.

Data protection by design

Privacy and security must be considered before a new account-managed service, Print Portal, ordering workflow, data field, integration, plugin, supplier, personalisation process, reporting feature or other material change is introduced. The assessment must consider necessity, user roles, access, data flows, recipients, retention, security, international access and the effect on individuals.

A data protection impact assessment screening will be completed for material new or changed processing. A full assessment will be completed before processing that is likely to create a high risk to individuals. Unresolved high risk must be escalated to the Directors and, where required, the Information Commissioner’s Office before processing begins. Atura will provide reasonable assistance with a customer’s impact assessment where it acts as processor.

Personal data breaches

Any loss, misdirection, unauthorised access, disclosure, alteration, destruction or material unavailability of personal data must be reported internally immediately. This includes information sent to the wrong supplier, courier or recipient, mistaken delivery details, incorrect portal permissions, compromised accounts, lost exports, insecure links and unintended publication. No one should delay reporting while investigating alone.

The Data Protection Leads will coordinate containment, recovery, evidence preservation, risk assessment, documentation and communication. Every breach and notification decision will be recorded.

Where Atura acts as processor, it will notify the relevant customer immediately and without undue delay after becoming aware of a personal data breach or other contract-defined Data Loss Event. Atura will comply with any shorter contractual deadline, provide available information promptly and continue to provide updates as details become known. Initial notification must not be delayed until the investigation is complete.

Where Atura acts as controller, it will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach. Affected individuals will be informed without undue delay where the breach is likely to result in a high risk.

Direct marketing and cookies

Direct marketing and the use of cookies or similar storage and access technologies must comply with data protection law and the Privacy and Electronic Communications Regulations. Electronic marketing must use an appropriate permission or lawful route and provide a simple way to opt out. Objections to direct marketing must be respected and may be retained on a suppression list.

Non-essential cookies and similar technologies must not be activated before valid consent unless a specific legal exemption applies. Consent must be informed, recorded and as easy to withdraw as it is to give. Each Atura website and Print Portal must maintain current information about the technologies it uses, including their provider, purpose and duration.

Responsibilities training and records

The Directors are responsible for oversight, resources and approval of material risk decisions. The Directors also hold responsibility for data privacy and act as Atura’s Data Protection Leads. Atura has not appointed a statutory Data Protection Officer unless and until its processing activities make that appointment mandatory. The named contacts are Lee Sweeney and Stefan Whitelegg, who can be contacted on 0161 399 5842.

The Directors maintain this policy, coordinate individual rights requests and breaches, support contract and impact assessments, and monitor records and corrective actions.

Everyone with access to personal data must complete training appropriate to their responsibilities, follow approved procedures, protect credentials and report errors or concerns immediately. Personnel handling government information must also complete any classification, security or contract-specific training required for their role. Deliberate, reckless or repeated non-compliance may result in removal of access, disciplinary action, termination of a contract or business relationship, legal action or notification to an authority.

Atura will maintain proportionate records of processing activities, controller and processor roles, lawful bases, customer instructions, systems, data flows, subprocessors, contracts, international transfers, retention, individual rights requests, impact assessments, breaches, training, access reviews and compliance reviews. 

Contact and review

Questions, requests or concerns about this policy should be sent to Atura Group Limited at sales@aturagroup.co.uk or 0161 399 5842. A matter involving the usual contact should be raised with another Director. Rights requests and incident notifications received through any channel must be forwarded immediately to a Data Protection Lead.

This policy will be reviewed at least annually and after a material change in law, regulatory guidance, account-managed customer services, Print Portals, 20i hosting, Clarity, connected services, suppliers, international processing, government contract requirements or Atura’s operations. The review will consider whether the policy matches actual practice and whether supporting contracts, registers, retention rules and security controls remain current.