Data Protection Policy

This policy sets out how Long Communications Ltd approaches data protection as a business — not just on this website, but across the consultancy work we do. We're publishing it so that clients carrying out their own due diligence can see how we handle data, including any customer or call data we may come across while reviewing a client's contact centre or telephony setup.

For how we specifically handle data collected through this website, see our Privacy Policy.

Scope and purpose

This policy applies to all personal data processed by Long Communications Ltd, whether that's data about website visitors and enquirers, or data belonging to our clients and their customers that we're given access to in the course of a consultancy engagement (for example, call volume reports, sample call recordings, or CRM exports used to diagnose a contact centre setup).

Our compliance framework

We process personal data in line with the UK GDPR and the Data Protection Act 2018. As a small, director-led consultancy, Ben Long holds personal responsibility for data protection compliance across the business, acting as the point of contact for any data protection query, request, or incident. A dedicated Data Protection Officer is not legally required for a business of this size and nature, and none has been appointed.

The principles we follow

Lawfulness, fairness and transparency — we're clear about what data we collect and why.
Purpose limitation — data is collected for specific, stated reasons and not reused for unrelated purposes.
Data minimisation — we only ask for what we actually need to do the work.
Accuracy — we correct inaccurate data when we become aware of it.
Storage limitation — data isn't kept longer than needed (see retention, below).
Integrity and confidentiality — data is kept secure against loss, misuse, or unauthorised access.
Accountability — we can demonstrate how we meet the principles above, including through this policy.

Client and customer data encountered during consultancy work

Where a client shares their own business or customer data with us as part of a review (for example, call statistics, staffing data, or samples of customer interactions), we act as a data processor on that client's behalf. In that context:

we process the data only on the client's documented instructions, and only for the purpose of the agreed engagement;
we don't use it for our own purposes, and don't retain it beyond what's needed to complete the work;
we treat it as confidential, whether or not a separate non-disclosure or data processing agreement has been signed;
we'll sign a client's own Data Processing Agreement where they require one; and
we return or securely delete client data at the end of an engagement, unless the client asks us to keep it for an agreed reason.

Security measures

Given the size of the business, our security measures are proportionate but deliberately careful given the sensitivity of the data involved:

devices used to access client or customer data are password/passcode-protected and encrypted;
access to client data is limited to Ben Long — data isn't shared with subcontractors without the client's knowledge;
we use reputable, established third-party platforms (such as Netlify for this website) rather than building unnecessary custom infrastructure that could introduce risk; and
we avoid collecting or retaining more data than a given task requires.

Data retention

Enquiry data collected via this website is retained as described in our Privacy Policy. Client and customer data shared with us for a specific engagement is retained only for the length of that engagement, plus any period the client asks us to keep it for handover or reference, and is then securely deleted.

International transfers

We don't routinely transfer client or customer data outside the UK. Where a third-party tool we use (such as our website host) processes data outside the UK/EEA, it does so under appropriate safeguards such as Standard Contractual Clauses — see our Privacy Policy for the specific services involved on this website.

Third-party processors

Before using any new software or service that would process personal data on our behalf, we check that provider's own data protection commitments (their privacy policy, security practices, and where their servers are located) before adopting it.

Handling data subject requests

If you ask us to access, correct, delete, or otherwise deal with your personal data under UK GDPR, we aim to acknowledge the request promptly and respond within one month, as required by law. Contact ben.long@long-communications.com to make a request.

Personal data breaches

If we become aware of a personal data breach, we will assess the risk it poses to affected individuals without undue delay. Where required by law, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, and notify affected individuals directly where the breach is likely to result in a high risk to their rights and freedoms. Any client whose data is affected will be told as soon as possible.

Reviewing this policy

This policy is reviewed at least annually, and whenever we make a material change to how we handle data — for example, adopting a new tool or changing how an engagement is scoped.

Contact

Questions about this policy, or about how we've handled your data or your organisation's data, can be sent to ben.long@long-communications.com.