top of page
Three-Counties-Data-Protection-logo

Privacy Notice

Last Updated 28/06/2026

Who I Am

Three Counties Data Protection is a sole trader business operated by Liz Sydenham, providing data protection compliance consultancy to small businesses and organisations across Worcestershire, Herefordshire and Gloucestershire. Three Counties Data Protection is registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC183815. You can contact me at hello@threecountiesdata.co.uk, by telephone 01684 876196, or by post at Three Counties Data Protection, Long Meadow, Uckinghall, Tewkesbury, GL20 6ES.

What Information I Collect

I collect information you provide directly to me, including your name, email address, telephone number, and organisation details when you contact me through my website, by email, or by telephone.

 

If you engage me to provide a service, I may also collect information relevant to that engagement - for example, documents and information about your organisation's data processing practices if you commission an audit, or details needed to draft documents on your behalf.

 

If you use the contact form on my website, the information you submit is collected by Wix (my website provider) and passed to me by email. Please note that Wix may also collect technical data about your visit to my website, including through the use of cookies. For more information about how cookies are used on this site, please see my Cookie Policy.

Why I Collect It and My Lawful Basis

I process your information for the following purposes:

​

  • Responding to enquiries and providing quotes - lawful basis: legitimate interests

  • Delivering contracted services such as audits, document drafting and training - lawful basis: performance of a contract

  • Maintaining business records for accounting and tax purposes - lawful basis: legal obligation

  • Sending you relevant updates or information where you have asked to hear from me - lawful basis: consent

 

I do not use your information for any purpose beyond what is necessary to provide my services and run my business.

My Role as Data Processor

Where I handle personal data belonging to your staff, customers, or other individuals in the course of providing a service - for example, during a data protection audit - I act as a data processor on your behalf. In those circumstances, I process that data only in accordance with your instructions and my obligations under UK GDPR. A Data Processing Agreement is available on request and will be put in place wherever required.

How Long I Keep It

I retain client engagement records, including correspondence and deliverables, for six years after the end of an engagement, in line with my professional and legal obligations. Enquiry details from contacts who do not become clients are retained for six months before deletion. If you have consented to receive updates from me, I will retain your contact details for that purpose until you unsubscribe.

Who I Share It With

I do not share your information with third parties except where necessary to deliver my services or comply with the law. The third parties I work with are:

 

  • Wix - website hosting, contact form processing, and email marketing (if you sign up to receive updates)

  • Microsoft 365 - email and document storage

 

I do not sell or rent personal information to anyone.

International Transfers

Some of the third parties listed above, including Wix and Microsoft, may process data outside the United Kingdom. Where this occurs, I satisfy myself that appropriate safeguards are in place in accordance with UK GDPR before using their services.

Keeping Your Information Secure

I use cloud-based tools with appropriate access controls and automatic backup to protect the information you share with me. Documents shared for audit or review purposes are handled in accordance with my own data protection obligations.

Automated Decision Making

I do not use automated decision making or profiling in connection with your personal data.

Your Rights

Under UK GDPR, you have the right to:

​

  • Access the information I hold about you

  • Request correction of inaccurate information

  • Request deletion of your information in certain circumstances

  • Object to or restrict certain processing

  • Receive a copy of your information in a portable format

  • Withdraw consent at any time where processing is based on consent

 

To exercise any of these rights, or to unsubscribe from updates, please contact me at hello@threecountiesdata.co.uk. I will respond promptly and always within one month.

 

You also have the right to complain to the Information Commissioner's Office at ico.org.uk if you believe I have not handled your information correctly.

Changes To This Notice

I may update this notice from time to time. The date at the top of this page reflects the most recent revision. Where changes are significant, I will take reasonable steps to bring them to your attention.

Contact

If you have any questions about this notice or how I handle your information, please contact me at hello@threecountiesdata.co.uk or 01684 876196

bottom of page