UK GDPR & Data Protection Policy

Effective Date: 22 August 2026
Last Updated: 22 August 2026

1. Purpose

NP UK Corporate Services Ltd (“the Company”, “we”, “us” or “our”) is committed to handling personal information lawfully, fairly, securely and transparently.

This UK GDPR & Data Protection Policy explains the Company’s approach to personal data protection and applies to personal information processed through:

yourbusinessadmin.co.uk;
client onboarding;
service delivery;
corporate and compliance services;
communications;
accounts and payments;
business administration; and
our internal business operations.

The Company will comply with applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018, as amended or supplemented from time to time.

2. Data Protection Principles

We aim to ensure that personal information is:

processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
accurate and kept up to date where necessary;
retained only for as long as necessary;
processed securely; and
handled in a manner that allows the Company to demonstrate compliance.

3. Lawful Processing

Before processing personal information, we identify an appropriate lawful basis.

Depending on the circumstances, processing may rely on:

consent;
performance of a contract;
steps taken before entering into a contract;
compliance with a legal obligation;
protection of vital interests;
recognised legitimate interests where applicable; or
legitimate interests.

The lawful basis used will depend on the specific purpose of the processing.

4. Legitimate Interests

Where we rely on legitimate interests, we will consider:

the legitimate interest being pursued;
whether processing is necessary for that purpose; and
whether the individual’s rights and freedoms override our interests.

Examples may include:

protecting our systems;
preventing fraud;
managing our business;
maintaining client relationships;
improving our services;
responding to enquiries;
enforcing agreements; and
establishing or defending legal claims.

Where required, we will maintain appropriate records of legitimate interest assessments.

5. Data Minimisation

We will seek to collect only information that is reasonably necessary for the relevant purpose.

We will not intentionally collect excessive personal information where it is unnecessary for providing the service or meeting a legal or regulatory obligation.

6. Accuracy

We take reasonable steps to ensure personal information is accurate and up to date.

Clients should notify us if information supplied to us changes or is inaccurate.

7. Security

We use appropriate technical and organisational measures designed to protect personal information.

Depending on the circumstances, these measures may include:

access controls;
authentication mechanisms;
secure systems;
restricted access to client information;
backups;
security monitoring;
malware and threat protection;
secure transmission methods; and
staff confidentiality obligations.

8. Access Control

Access to personal information will be limited to individuals who reasonably require access for their role.

Personnel and contractors who have access to personal information may be subject to confidentiality requirements.

9. Data Retention

We maintain retention periods based on:

the purpose for which information was collected;
legal and regulatory requirements;
accounting and tax requirements;
contractual requirements;
professional obligations; and
the need to establish, exercise or defend legal claims.

Personal information will be securely deleted, anonymised or otherwise disposed of when it is no longer required.

10. Third-Party Processors

We may use third-party service providers to process personal information on our behalf.

These may include:

hosting providers;
cloud storage providers;
payment processors;
email providers;
CRM systems;
accounting software;
identity verification providers;
cybersecurity providers;
analytics providers; and
other technology or professional service providers.

Where applicable, we will ensure appropriate contractual and security arrangements are in place.

11. International Data Transfers

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are used where required by applicable data protection law.

These safeguards may include applicable adequacy regulations or approved contractual safeguards.

12. Data Subject Rights

Individuals may have rights under UK data protection law, including rights to:

access their personal information;
correct inaccurate information;
request deletion;
restrict processing;
object to certain processing;
receive certain information in a portable format;
withdraw consent where consent is relied upon; and
object to direct marketing.

These rights are subject to applicable legal conditions and exemptions.

13. Subject Access Requests

Individuals may request access to personal information held about them.

Requests should be sent to:

services@yourbusinessadmin.co.uk

We may need to verify the identity of the requester before releasing information.

We will respond within the applicable statutory timeframe.

14. Data Breach Management

A personal data breach may include:

accidental disclosure;
unauthorised access;
loss of personal information;
theft;
destruction;
alteration; or
other unlawful access to personal information.

If a breach occurs, we will assess its nature, scope and potential impact.

Where required by law, we will notify the ICO within the applicable timeframe and communicate with affected individuals where required.

15. Data Protection by Design

Where appropriate, privacy and data protection considerations will be incorporated into new systems, services and processes.

We will consider:

what personal information is required;
why it is required;
who needs access;
how long it should be retained;
how it should be secured; and
whether a less intrusive method is available.

16. Special Category Data

Where special category information is processed, we will identify an appropriate Article 6 lawful basis and, where required, an additional condition for processing special category data.

Access to such information will be restricted appropriately.

17. Criminal Offence Data and Compliance Checks

Where services require AML, sanctions, identity, beneficial ownership, PSC or other compliance checks, we may process relevant information where permitted and required by law.

Where criminal offence data is involved, we will ensure that the applicable legal requirements and additional conditions for processing are satisfied.

18. Cookies and Electronic Communications

The website may use cookies and similar technologies.

Where consent is legally required for non-essential cookies, appropriate consent mechanisms will be used.

Electronic marketing communications will be conducted in accordance with applicable privacy and electronic communications requirements.

19. Direct Marketing

We will only send direct marketing communications where permitted under applicable law.

Where consent is required, we will obtain appropriate consent.

Recipients may opt out of marketing communications at any time.

20. Accountability

The Company will maintain appropriate records and processes to demonstrate compliance with applicable data protection requirements.

This may include:

records of processing activities;
privacy notices;
data retention procedures;
security measures;
data breach procedures;
processor arrangements;
data protection assessments where required; and
records of lawful bases.

21. Staff and Contractors

Personnel handling personal information will be expected to:

maintain confidentiality;
access information only when authorised;
follow security procedures;
report suspected data breaches;
use personal information only for authorised purposes; and
comply with applicable data protection procedures.

22. Complaints

If you believe that your personal information has been handled improperly, please contact:

NP UK Corporate Services Ltd

Email: services@yourbusinessadmin.co.uk

We will investigate the matter and attempt to resolve your concern.

You may also complain to the UK’s Information Commissioner’s Office.

ICO website: https://ico.org.uk/

23. Policy Review

This policy will be reviewed periodically and whenever there are significant changes to:

applicable data protection legislation;
our business activities;
our technology;
our data processing activities; or
regulatory guidance.

24. Contact Details