Privacy Policy

1. Introduction

1.1 We are committed to safeguarding the privacy of our website visitors, service users, individual customers and customer personnel to our website, Caparava

1.2 This policy applies where we are acting as a data controller with respect to the personal data of such persons; in other words, where we determine the purposes and means of the processing of that personal data.

1.3 In this policy, “we”, “us” and “our” refer to Clare O’Callaghan. For more information about us, see Section 10.

2. Credit

2.1 This document was created using a template from Docular (https://seqlegal.com/free-legal-documents/privacy-policy).

3. The personal data that we collect

3.1 In this Section 3 we have set out the general categories of personal data that we process and, in the case of personal data that we did not obtain directly from you, information about the source and specific categories of that data.

3.2 We may process data enabling us to get in touch with you (“contact data“).[ The contact data may include your name, email address, telephone number, postal address and/or social media account identifiers. The source of the contact data is you and/or your employer. If you log into our website using a social media account, we will obtain elements of the contact data from the relevant social media account provider.

3.3 We may process your website user account data (“account data“). The account data may include your account identifier, name, email address, business name, account creation and modification dates, website settings and marketing preferences. The primary source of the account data is you and/or your employer, although some elements of the account data may be generated by our website. If you log into our website using a social media account, we will obtain elements of the account data from the relevant social media account provider.

3.4 We may process information contained in or relating to any communication that you send to us or that we send to you (“communication data“). The communication data may include the communication content and metadata associated with the communication. Our website will generate the metadata associated with communications made using the website contact forms.

3.6 We may process data about your use of our website and services] (“usage data“). The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. The source of the usage data is our analytics tracking system.

4. Purposes of processing and legal bases

4.1 In this Section 4, we have set out the purposes for which we may process personal data and the legal bases of the processing.

4.2 Operations – We may process your personal data for the purposes of operating our website, providing our services, generating invoices, bills and other payment-related documentation, and credit control. The legal basis for this processing is our legitimate interests, namely the proper administration of our website, services and business.

4.3 Publications – We may process account data for the purposes of publishing such data on our website and elsewhere through our services in accordance with your express instructions. The legal basis for this processing is our legitimate interests, namely the publication of content in the ordinary course of our operations.

4.4 Relationships and communications – We may process contact data, account data, transaction data and/or communication data for the purposes of managing our relationships, communicating with you (excluding communicating for the purposes of direct marketing) by email, SMS, post, fax and/or telephone, providing support services and complaint handling. The legal basis for this processing is our legitimate interests, namely communications with our website visitors, service users, individual customers and customer personnel, the maintenance of relationships, and the proper administration of our website, services and business.

4.5 Direct marketing – We may process contact data, account data and/or transaction data for the purposes of creating, targeting and sending direct marketing communications by email, SMS, post and/or fax and making contact by telephone for marketing-related purposes. The legal basis for this processing is our legitimate interests, namely promoting our business and communicating marketing messages and offers to our website visitors and service users.

4.6 Research and analysis – We may process [usage data and/or transaction data for the purposes of researching and analysing the use of our website and services, as well as researching and analysing other interactions with our business. The legal basis for this processing is our legitimate interests, namely monitoring, supporting, improving and securing our website, services and business generally.

4.7 Record keeping – We may process your personal data for the purposes of creating and maintaining our databases, back-up copies of our databases and our business records generally. The legal basis for this processing is our legitimate interests, namely ensuring that we have access to all the information we need to properly and efficiently run our business in accordance with this policy.

4.8 Security – We may process your personal data for the purposes of security and the prevention of fraud and other criminal activity. The legal basis of this processing is our legitimate interests, namely the protection of our website, services and business, and the protection of others.

4.9 Insurance and risk management – We may process your personal data where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks and/or obtaining professional advice. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.

4.10 Legal claims – We may process your personal data where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.

4.11 Legal compliance and vital interests – We may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or in order to protect your vital interests or the vital interests of another natural person.

5. Providing your personal data to others

5.1 We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice.

5.2 Your personal data held in our website database contact data, account data and/or transaction data will be stored on the servers of our hosting services providers, www.caparava.co.uk

5.3 We may disclose your personal data to our suppliers or subcontractors insofar as reasonably necessary for managing our relationships and communicating with you.

5.4 In addition to the specific disclosures of personal data set out in this Section 5, we may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

6. Retaining and deleting personal data

6.1 This Section 6 sets out our data retention policies and procedures, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.

6.2 Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6.3 We will retain your personal data as follows:

(a) contact data will be retained for a minimum period of 3 years following the date of the most recent contact between you and us, and for a maximum period of 5 years following that date.

(b) account data will be retained for a minimum period of 3 years following the date of closure of the relevant account, and for a maximum period of 3 years following that date.

(c) communication data will be retained for a minimum period of 3 yearsfollowing the date of the communication in question, and for a maximum period of 3 years following that date.

6.4 Notwithstanding the other provisions of this Section 6, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

7. Your rights

7.1 In this Section 7, we have listed the rights that you have under data protection law.

7.2    Your principal rights under data protection law are:
(a)    the right to access – you can ask for copies of your personal data.
(b)    the right to rectification – you can ask us to rectify inaccurate personal data and to complete incomplete personal data.
(c)    the right to erasure – you can ask us to erase your personal data.
(d)    the right to restrict processing – you can ask us to restrict the processing of your personal data.
(e)    the right to object to processing – you can object to the processing of your personal data.
(f)    the right to data portability – you can ask that we transfer your personal data to another organisation or to you.
(g)    the right to complain to a supervisory authority – you can complain about our processing of your personal data
(h)    the right to withdraw consent – to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent.

7.3 You may exercise any of your rights in relation to your personal data by written notice to us, using the contact details set out below.

8. Amendments

8.1 We may update this policy from time to time by publishing a new version on our website.

8.2 You should check this page occasionally to ensure you are happy with any changes to this policy.

8.3 We may notify you of significant changes to this policy by email.

9. Our details

9.1 This website is owned and operated by Caparava

9.2 Our office is at 35 Elmbridge Avenue, Surbiton, KT5 9EZ.

9.2b. We are VAT Registered – VAT registration number: 489 1478 36.

9.3 Our principal place of business is at 35 Elmbridge Avenue, Surbiton, KT5 9EZ.

9.4 You can contact us:

(a)    by post, to the postal address given above.
(b)    using our website contact form.
(c)    by telephone, on the contact number published on our website.
(d)    by email, using the email address published on our website.

10. Data protection officer

10.1 Our data protection officer’s contact details are: Clare O’Callaghan at clare@caparava.co.uk, 0203 645 4507.

Data protection complaints notice

How to raise a concern with us about your personal data

Published by: Caparava | Last reviewed: 7^th July 2026

About this notice

We take the privacy and security of your personal data seriously. If you have a concern about how we have collected, used, shared, stored or deleted your personal information – including how we have used any automated tools or AI in a way that affects your personal data – we want to hear from you. We will do our best to put things right.

This notice explains your rights, how to raise a concern with us, what to expect when you do, and what to do if you are not satisfied with our response.

Your right to complain directly to us is a statutory right under the Data (Use and Access) Act 2025. You do not need to go to the ICO first – we are your first point of contact, though you are always free to contact the ICO directly if you prefer.

Your rights under UK data protection law

Under UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, you have the right to:

Access the personal data we hold about you (sometimes called a subject access request, or SAR).
Ask us to correct information that is wrong or incomplete.
Ask us to delete your data in certain circumstances.
Ask us to restrict how we use your data while a complaint is being looked into.
Receive a copy of your data in a commonly used, portable format.
Object to us using your data in certain ways.
Not be subject to a decision made solely by automated means where that decision has a significant effect on you.
Under the Data (Use and Access) Act 2025, ask us to explain in plain terms how an automated decision affecting you was made, request that a person reviews that decision, and ask us to reconsider the outcome.

If you would like to exercise any of these rights, please contact us using the details below.

Who we are and who to contact

Data protection at Caparava is the responsibility of:

Responsible person	Clare O’Callaghan
Email	clare@caparava.co.uk,
Phone	0203 645 4507
Post	35 Elmbridge Avenue, Surbiton, KT5 9EZ

We accept complaints however they reach us – by email, phone, post, social media or in person. However your complaint arrives, we will log it and handle it in the same way. You do not need to use a particular form or format to make a complaint.

What counts as a data protection complaint

A data protection complaint is any concern you raise about how we have collected, used, stored, shared or deleted your personal data. This is broad – it covers a wide range of situations, not just formal data breaches.

Examples of the types of concern we can investigate

We did not respond to a data subject access request (a request to see what information we hold about you) within the required time, or the response was incomplete.
We collected or used your personal data without a valid lawful basis, or for a purpose you were not told about.
We shared your personal data with someone we should not have, or without a lawful reason to do so.
We did not action a request to delete, correct or restrict your personal data when we were required to.
We kept your personal data for longer than necessary.
A data breach or security incident affected your personal data and we did not handle it correctly.
You continued to receive marketing from us after you had opted out.
Our privacy notice was unclear, incomplete or did not accurately describe how we use your data.
We used AI or an automated tool in a way that affected your personal data without proper safeguards, transparency or human oversight.
You believe an automated or AI-assisted decision affected you unfairly and your request for a human review was not handled properly.

What this process does not cover

General dissatisfaction with the quality of our service, where personal data is not the issue – please contact us at [service contact] and we will do our best to help.
Billing or payment queries – please contact us at clare@caparava.co.uk
Complaints about the outcome of a data subject access request that was handled correctly and on time.
Complaints about a third party’s conduct or professional practice – these should be directed to the relevant professional body or regulator.
Employment or HR grievances – these follow a separate process, even where a data request forms part of the grievance.

If you are not sure whether your concern is a data protection matter, please contact us anyway and we will help you direct it to the right place.

There are no formal requirements for how you raise a complaint. You can contact us verbally, in writing, or through any of the channels listed above.

How to raise a complaint with us

To help us investigate your concern as quickly as possible, it helps if you can tell us:

Your name and contact details.
A clear description of your concern – what happened, when, and who was involved.
Any relevant reference numbers, screenshots or correspondence.
What outcome you would like.

You do not need to provide all of this to make a valid complaint. If you are not sure what to include, just get in touch and we will help you from there.

What happens when we receive your complaint

Here is what you can expect from us, step by step:

Step 1 – Acknowledgement (within 30 calendar days)

We will send you a written acknowledgement within 30 calendar days of receiving your complaint, including weekends and bank holidays. Day one of that period is the day after we receive it.Our acknowledgement will confirm:That we have received your complaint and the date we received it.The name of the person who will be handling it.What happens next and an expected timescale.

Step 2 – Investigation

We will investigate your complaint fairly and thoroughly, without undue delay. This may include reviewing records and system logs, and speaking to relevant team members or suppliers.

Step 3 – Keeping you informed

We will not go silent while we are investigating. If we need more information from you, or if anything changes, we will get in touch as soon as possible.

Step 4 – Our response

We aim to give you a full response within one calendar month of receiving your complaint. In complex cases, we may extend this by up to a further two months. If we need to do this, we will tell you within the first month and explain why.Our response will explain:What we investigated and how.What we found, and the reasons for our decision.What action (if any) we have taken or will take as a result.Your right to take your complaint to the ICO if you are not satisfied.

We will not charge a fee for handling your complaint, unless it is clearly unfounded or excessive – in which case we will explain this to you before proceeding.

Complaints about AI or automated decisions

If your concern relates to how AI or an automated tool has been used in connection with your personal data, we will review:

Whether AI or an automated tool was used, and at what stage of the process.
Whether the use was lawful, fair and transparent.
Whether appropriate human oversight was in place at the point any decision was made.

We will not use AI alone to decide the outcome of a data protection complaint – a named member of our team will handle the investigation and response personally.

Where your complaint relates to an automated or AI-assisted decision, you have additional rights under the Data (Use and Access) Act 2025, including the right to ask us to explain how the process worked in plain English, to request a human review, and to ask us to reconsider the outcome. The person carrying out that review has full authority to change the original decision, not simply confirm it.

Third-party tools and suppliers

Where our processes involve third-party tools, platforms or suppliers, we remain your single point of contact for any data protection complaint. You do not need to contact our suppliers directly – we will liaise with them on your behalf as part of our investigation and keep you informed of the outcome.

How we keep records

We keep records of all data protection complaints we receive, the steps we take to investigate them, and the outcomes. This helps us respond consistently, identify any recurring issues, and demonstrate compliance if needed.

Complaint records are held securely and only accessed by those who need to handle the matter. Please note that the Information Commissioner’s Office (ICO) may request access to our complaint records as part of its regulatory role, and we are required to provide them.

If you are not satisfied with our response

If you remain unhappy after we have responded – or at any point during our process – you have the right to refer the matter to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. You do not have to wait for us to finish before contacting the ICO, and you do not have to raise your concern with us first, though we would always appreciate the opportunity to put things right.

ICO website	ico.org.uk
Helpline	0303 123 1113 (Monday to Friday, 9am to 4:30pm)
Live chat	Available at ico.org.uk
Post	Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Our ICO registration

Caparava is registered with the Information Commissioner’s Office under registration number ZB243841 You can verify this at ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/.

Accessibility

We want this process to be accessible to everyone. If you need this notice in a different format – for example, in large print, or if you would like to speak to someone directly rather than communicate in writing – please let us know and we will do our best to help.

This notice was last reviewed in July 2026. We review it at least once a year and update it whenever our contact details or processes change. If you have questions about this notice, please contact us at clare@caparava.co.uk,