GDPR Compliance

Introduction

Trenh Engineering is committed to ensuring the protection and security of the personal data that we process. This GDPR Compliance statement outlines how we comply with the General Data Protection Regulation (GDPR) and your rights as a data subject.

The GDPR is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It also addresses the export of personal data outside the EU and EEA areas.

Our Commitment to GDPR

Trenh Engineering is dedicated to protecting the personal data of individuals and complying with the GDPR. We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Regular staff training on data protection
• Implementation of data protection policies and procedures
• Security measures to protect personal data
• Regular review and update of data processing activities
• Data protection impact assessments where necessary

Data Protection Principles

Trenh Engineering processes personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner.
• Purpose limitation: We collect personal data for specified, explicit, and legitimate purposes.
• Data minimization: We ensure that personal data is adequate, relevant, and limited to what is necessary.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
• Storage limitation: We keep personal data in a form that permits identification for no longer than necessary.
• Integrity and confidentiality: We process personal data in a manner that ensures appropriate security.
• Accountability: We are responsible for and can demonstrate compliance with the GDPR.

Lawful Basis for Processing

We only process personal data where we have a lawful basis to do so. The lawful bases we rely on for processing personal data include:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract with you.
• Legal obligation: Where processing is necessary for compliance with a legal obligation.
• Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided your rights do not override these interests.

Your Rights Under GDPR

The GDPR provides individuals with enhanced rights regarding their personal data. As a data subject, you have the following rights:

• Right to be informed: About how we collect and use your personal data.
• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To have inaccurate personal data corrected or completed if it is incomplete.
• Right to erasure: To request the deletion or removal of personal data in certain circumstances.
• Right to restrict processing: To request the limiting of how we use your data in certain circumstances.
• Right to data portability: To request that we transfer your data to another controller or directly to you.
• Right to object: To object to the processing of your personal data in certain circumstances.
• Rights related to automated decision-making including profiling: Safeguards to protect against potentially damaging decisions without human intervention.

Data Subject Access Requests

You have the right to access your personal data that we hold. This is commonly known as a 'data subject access request' (DSAR). To make a DSAR, please contact us using the details provided at the end of this document.

We will respond to your request within one month. This can be extended by two further months where necessary, taking into account the complexity and number of requests.

We will not charge a fee for processing your request unless it is manifestly unfounded, excessive, or repetitive.

International Data Transfers

We may transfer personal data to countries outside the European Economic Area (EEA). When we do so, we ensure that appropriate safeguards are in place to protect your data, such as:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules
• Transfers to countries that have been deemed to provide an adequate level of protection

Data Protection Officer

While not legally required for our organization, we have voluntarily appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with the GDPR.

Data Breach Notification

In the event of a personal data breach, we have procedures in place to detect, report, and investigate the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

Contact Us

If you have any questions about this GDPR Compliance statement or wish to exercise your rights under the GDPR, please contact us at: