Last updated: February 2026
Avalon SaaS Ltd Trading as Avalon Data (Co. No. 14158613)
Effective Date:
Regulatory Framework: UK GDPR | DPA 2018 | DUAA 2025 | SRA Transparency Rules 2018
Avalon Data ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website avalondata.co.uk (the "Website").
Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Website.
We may collect personal data, including:
We use your personal data for the following purposes:
Under the UK General Data Protection Regulation (UK GDPR) and the Data (Use and Access) Act 2025, we process your personal data based on:
In accordance with Article 28 of the UK GDPR and the DUAA 2025, Avalon Data maintains a comprehensive Registry of all third-party sub-processors. We do not share data with generic 'service providers'; we only engage specific, vetted partners governed by a legally binding Data Processing Agreement (DPA). Our current sub-processors, their purposes, and their data locations are disclosed transparently in the table below (Section 5.1). This list serves as the definitive disclosure required under Article 13(1)(e).
| Processor Name | Purpose of Processing | Data Location | Safeguards |
|---|---|---|---|
| LandingSite.ai | Website Hosting & Site Builder Platform: Hosting of avalondata.co.uk and the AI-powered editor used to publish content. | USA | UK Standard Contractual Clauses, TLS encryption in transit. |
| Cloudflare | Domain Registrar, DNS, CDN & DDoS Proxy: Registration of avalondata.co.uk, traffic routing, and edge caching. All visitor traffic passes through Cloudflare's network before reaching our hosting. | UK / Global edge network | UK Data Processing Addendum, ISO 27001 certified, EU-US Data Privacy Framework certified. |
| Email (Google Workspace) for [email protected] and Google Fonts (delivery of the 'Outfit' typeface used across the site). | USA / Ireland | UK-Extension Data Privacy Framework certified, Standard Contractual Clauses. |
All Subprocessors are contractually bound by data processing agreements that include:
We will notify our clients at least 14 days before engaging any new Subprocessor to process personal data. Clients may object to the engagement of a new Subprocessor by contacting us at [email protected] within 14 days of receiving such notification.
We do not sell your personal data to third parties.
We do not simply rely on a processor's self-certification. Our 2026 Due Diligence Framework involves:
We have implemented appropriate technical and organisational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption, access controls, and regular security assessments.
Under UK GDPR, you have the following rights:
To ensure your request is handled securely and in accordance with the Data (Use and Access) Act 2025, please submit all Data Subject Access Requests (DSAR) via our Dedicated Privacy Portal. This structured process allows us to verify your identity and process your request within the statutory one-month window under UK GDPR Article 12(3).
Our Privacy Portal collects:
Submit a DSAR via our Privacy Portal →
We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, we retain enquiry data for 3 years and client data for 7 years in line with statutory limitation periods.
We retain personal data only for as long as is strictly necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.
| Data Category | Record Type | Retention Period | Statutory/Business Basis |
|---|---|---|---|
| Enquiry Data | Contact forms, initial email correspondence. | 3 Years from date of last contact. | Limitation Act 1980 (Potential claims period). |
| Client Matter Files | Case documents, legal advice, work product. | 7 Years from conclusion of the matter. | SRA Code of Conduct & Limitation Act 1980. |
| Financial Records | Invoices, VAT records, payment history. | 7 Years from the end of the financial year. | HMRC / VAT Act 1994. |
| Identity Verification | KYC/AML documents, passports, proof of address. | 5 Years from end of business relationship. | Money Laundering Regulations 2017. |
| Marketing Data | Newsletter subscriptions, opt-in preferences. | Until Opt-out (Reviewed every 24 months). | UK GDPR / PECR (Consent-based). |
| CCTV/Access Logs | Office visitor logs, security footage. | 30 Days (unless incident reported). | Public Interest/Security. |
We do not routinely process special category data. Our website audit service is designed to assess publicly accessible web pages and the contact details of firms we are engaged with. The personal data we handle is therefore typically limited to ordinary business contact information (name, work email, work phone, firm details).
If special category data is encountered: Should we ever inadvertently come across special category data (as defined in Article 9 UK GDPR) during a website audit — for example, in an example contained within a client's existing privacy policy — we apply the following measures:
If you have any concerns that special category data has been shared with us in error, please contact us immediately at [email protected] and we will arrange secure deletion.
Our Website uses cookies to distinguish you from other users and to improve your experience. For detailed information about the cookies we use, please refer to our Cookie Policy.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.
Avalon Data ("we", "us", or "our") provides independent website auditing and remediation services for the UK legal sector. We operate under an "Accountability-First" model. This policy outlines how we handle personal data in strict alignment with the Data (Use and Access) Act (DUAA) 2025 and the SRA Transparency Rules 2018. Regulatory Alignment: While Avalon Data is not an SRA-regulated entity, our services are specifically engineered to assist SRA-regulated firms in meeting their website-related disclosure obligations. We operate as a specialist third-party supplier, ensuring that our data handling, security standards, and website audit methodologies provide the 'Evidence of Oversight' required for a firm's regulatory defence.
We only process personal data where a valid lawful basis exists under Article 6 of the UK GDPR. In 2026, we specifically rely on:
We facilitate the exercise of your rights in a manner that is reasonable and proportionate:
In line with the Data (Use and Access) Act 2025 framework, we operate an internal-first complaints procedure. We encourage you to raise any concerns with us directly before escalating to the regulator:
Note: Under 2026 law, the Information Commission generally requires that you complete this internal process before escalating a complaint to the regulator.
We only transfer data outside the UK where the destination provides a level of protection that is not significantly lower than UK standards, as per the 2026 "Data Protection Test".
Avalon Data performs a formal Transfer Risk Assessment (TRA)—now defined under the DUAA 2025 as the 'Data Protection Test'—for every cross-border data flow. We ensure that the standard of protection in the destination country is not materially lower than that provided in the UK.
Our Validated Transfer Mechanisms:
If you have any questions about this Privacy Policy or our data practices, please contact us:
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Visit ico.org.uk for more information.
