Data Protection Policy

Last updated: 28 August 2026

This is the policy Dynamic Distribution works to when handling personal information. It sets out what we require of ourselves, our staff and our suppliers. Our Privacy statement is the outward facing document that tells people what we do with their information and what their rights are.

Scope

This policy applies to everyone who works for or on behalf of Dynamic Office Group Limited, trading as Dynamic Distribution, including employees, agency staff, contractors and directors. It covers all personal information we handle, in any format, whether we hold it as controller or as processor for a client.

Breaking this policy is a disciplinary matter. For contractors and suppliers it is a breach of contract.

Our two roles, and why the difference matters

Controller. For our own business information, we decide why and how it is processed: enquiries, client and supplier contacts, employees and applicants, site visitors and security records.

Processor. For the order and delivery data our clients send us so that we can fulfil their orders, our client is the controller and we act only on their documented instructions. This is the majority of the personal data passing through our warehouse by volume, and it is the part where a mistake would be most damaging, so the rules in the *Acting as a processor* section below are not optional.

If anyone is unsure which role applies to a piece of work, stop and ask before processing it.

The principles we work to

Everyone handling personal information must be able to show that it is:

1. Lawful, fair and transparent. We have a lawful basis before we start, and we tell people what we are doing in the Privacy statement.
2. Limited to a specified purpose. We use information for the reason it was collected, and we do not repurpose it without checking that we may.
3. Adequate but not excessive. We collect the minimum needed to do the job. Do not ask a client for a data field we have no use for.
4. Accurate. We correct errors promptly when we find them or are told about them.
5. Kept no longer than necessary. We follow the retention periods in the Privacy statement, or the client's contract where that governs.
6. Secure. Protected against unauthorised access, loss and damage by appropriate technical and organisational measures.
7. Accountable. We keep records that demonstrate all of the above.

Responsibilities

• The board owns this policy, provides the resources to meet it and reviews it annually.
• A named senior manager is accountable for day to day data protection, is the point of contact for the Information Commissioner's Office, maintains the record of processing activities and the supplier register, and owns the breach log. We are not required to appoint a statutory Data Protection Officer, and have not done so.
• Line managers make sure their teams have had training and follow this policy in practice.
• Everyone is responsible for protecting the information they handle, for reporting a suspected breach immediately, and for passing any rights request on the same day it arrives.

Acting as a processor for a client

When we handle personal data on a client's behalf we will:

• Act only on their documented instructions, and tell them if we believe an instruction breaks data protection law
• Put a written contract in place that meets Article 28 of the UK GDPR before processing starts
• Make sure everyone with access is under a duty of confidence
• Apply the security measures set out below
• Not engage a sub-processor without the client's authorisation, and impose the same terms on any we do engage. Carriers used to complete a delivery are named or described in the contract
• Assist the client with rights requests, breach notification, impact assessments and audits
• Delete or return the data at the end of the contract, and delete existing copies unless the law requires us to keep them
• Keep a record of the processing we carry out for them

We never use client delivery data for our own purposes, never market to a client's customers, and never enrich or resell it.

Security

• Access is granted on a least privilege basis and reviewed when someone changes role or leaves
• Accounts are individual, never shared, and protected by strong authentication
• Personal data is encrypted in transit, and devices are encrypted at rest
• Paper records containing personal data are locked away and destroyed by secure means
• Systems are patched, backed up and monitored, and backups are tested
• Personal data is not moved to personal devices, personal email or unapproved cloud services
• Visitors to our premises are signed in and supervised

Suppliers

Before a new supplier touches personal information we check that they can meet these standards, put the required contract terms in place, and record them in the supplier register with what they process and where. Existing suppliers are reviewed periodically and whenever the service changes.

Rights requests

Any request from an individual to see, correct, delete, restrict, object to or transfer their data must be passed to the responsible manager the day it is received, however it arrives and even if it does not use legal language.

We respond within one calendar month. That may be extended by two further months for genuinely complex requests, provided we tell the person within the first month. We do not charge, unless a request is manifestly unfounded or excessive.

If the request concerns data we hold as a processor, we pass it to the client without delay and tell the individual we have done so. We do not answer it ourselves.

Personal data breaches

A breach is any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. A parcel label showing the wrong customer's details is a breach. So is an email sent to the wrong recipient.

1. Report it immediately to the responsible manager. Do not attempt to investigate it alone and do not delete anything.
2. We contain the incident and assess the risk to the people affected.
3. Where there is a risk to their rights and freedoms, we notify the Information Commissioner's Office within 72 hours of becoming aware.
4. Where the risk is high, we tell the individuals affected without undue delay.
5. Where we are the processor, we tell the client without undue delay so that they can meet their own obligations. The decision to notify the regulator is theirs.
6. Every incident is recorded in the breach log with what happened, the effect and what we did, whether or not it was reportable.

Impact assessments

We carry out a Data Protection Impact Assessment before any processing likely to result in a high risk, including new large scale processing, new monitoring technology, or a materially new use of client data. The assessment is documented and reviewed before the work starts.

Training and review

Everyone receives data protection training at induction and a refresher at least annually, and records are kept. This policy is reviewed at least once a year, and whenever the law, our systems or our services change materially.

Contact

Dynamic Office Group Limited, trading as Dynamic Distribution
Registered in England and Wales, company number 11676242
Registered office: Unit 5 Lodge Way, Lodge Farm Industrial Estate, Northampton NN5 7RA, United Kingdom
VAT registration number: GB 372 8227 83
Email: sales@dynamicdistribution.co.uk
Phone: 01604 586 939

You may also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.