UK GDPR Statement

01Roles

Helpora Ltd is the controller for its own enquirers, clients, authors, subscribers to Helpora titles, and job applicants. Where we build or operate a portal that holds a client's records, the client is the controller and Helpora is the processor, acting only on documented instructions.

02Our commitments as a processor

• A written data processing agreement before any personal data is transferred, listing subject matter, duration, nature and purpose, categories of data and data subjects.
• Processing only on your documented instructions, and telling you if we believe an instruction breaches data protection law.
• Confidentiality obligations on every member of staff and contractor with access.
• Appropriate technical and organisational measures, including encryption in transit and at rest, least-privilege access, multi-factor authentication and tested backups.
• No sub-processor without your prior written authorisation, and flow-down of the same obligations.
• Assistance with data subject requests, impact assessments and regulator enquiries.
• Notification of a personal data breach without undue delay and in any event within 24 hours of becoming aware.
• Deletion or return of personal data at the end of the engagement, with written confirmation.

03Lawful basis in editorial and reference work

Reference records about identifiable people are processed under legitimate interests, with the balancing test recorded. Where the purpose is journalism, academic, artistic or literary, or archiving in the public interest, we rely on the corresponding exemptions in Schedule 2 of the Data Protection Act 2018 and record which exemption applies to which dataset.

04Data protection by design

New datasets and portals are assessed before build: what fields are genuinely needed, whether a field can be aggregated or removed, how long records are kept, and who can see them. A data protection impact assessment is carried out where processing is likely to be high risk, and the outcome is shared with the client.

05International transfers

Transfers outside the UK are made under adequacy regulations, or the International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment.

06Records and review

We maintain a record of processing activities, a register of sub-processors, a breach log and a retention schedule, and review them annually or when a material change occurs.

07Contact

Data protection enquiries, processing agreements and breach notifications: hello@helpora.uk, marked for the attention of the data protection lead. Supervisory authority: the Information Commissioner's Office, ico.org.uk.