Data Protection & Cybersecurity Statement

At Treasure Well Law Associates Ltd ("Treasure Well"), protecting personal information and maintaining information security are fundamental to the way we conduct our business.

We are committed to handling personal and business information responsibly, maintaining appropriate safeguards to protect confidential information, and complying with applicable data protection legislation in the jurisdictions in which we operate.

This Statement outlines our approach to data protection, cybersecurity, and responsible information governance.

Data Protection Principles

Treasure Well processes personal information in accordance with applicable data protection legislation and recognised principles of responsible information management.

We are committed to:

• processing personal information lawfully, fairly, and transparently;

• collecting information only for legitimate business purposes;

• limiting data collection to information that is relevant and necessary;

• maintaining accurate and up-to-date records where appropriate;

• retaining information only for as long as necessary;

• protecting personal information through appropriate security measures.

Applicable Data Protection Legislation

Where applicable, Treasure Well seeks to comply with relevant data protection legislation, including:

• UK General Data Protection Regulation (UK GDPR);

• EU General Data Protection Regulation (EU GDPR), where applicable;

• Data Protection Act 2018 (United Kingdom).

Lawful Basis for Processing

Where required under applicable data protection legislation, Treasure Well processes personal information on one or more of the following lawful bases:

• performance of a contract or steps taken prior to entering into a contract;

• compliance with legal obligations;

• legitimate business interests;

• the individual's consent, where required.

Collection and Use of Information

Treasure Well collects and processes personal information only where reasonably necessary for the operation of our business and the delivery of our consultancy services.

Information may be used for purposes including:

• responding to enquiries;

• administering client engagements;

• communicating with clients and business partners;

• complying with applicable legal or regulatory obligations;

• maintaining the security and integrity of our systems and services.

International Data Transfers

Where personal information is transferred internationally, Treasure Well seeks to ensure that appropriate safeguards are implemented in accordance with applicable data protection legislation.

Where appropriate, personal information is transferred only where adequate levels of protection are available or suitable safeguards have been implemented.

Information Security

Treasure Well maintains appropriate administrative, organisational, and technical measures designed to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction.

Our information security measures may include:

• secure access controls;

• restricted access to confidential information on a need-to-know basis;

• appropriate password and authentication procedures;

• secure storage of electronic information;

• periodic review of internal security procedures.

While no method of electronic communication or data storage can guarantee absolute security, we continually seek to maintain appropriate safeguards consistent with the nature of our business.

Confidentiality

All members of our team are expected to treat confidential information responsibly and in accordance with our internal policies and professional standards.

Confidential information is only disclosed where:

• authorised by the client;

• necessary for the relevant engagement;

• required by applicable law or regulatory obligation.

Data Subject Rights

Where applicable under data protection legislation, individuals may have rights including:

• the right of access;

• the right to rectification;

• the right to erasure;

• the right to restrict processing;

• the right to object to processing;

• the right to data portability.

Requests relating to personal information may be submitted using the contact details provided below.

Data Breach Management

Treasure Well maintains procedures for assessing and responding to suspected or confirmed information security incidents.

Where required by applicable law, relevant supervisory authorities and affected individuals will be notified within the applicable statutory timeframes.

Continuous Improvement

Treasure Well periodically reviews its policies, procedures, and information security practices to support the ongoing protection of personal information and to reflect developments in applicable legislation and recognised good practice.

Contact

Questions regarding this Statement or requests relating to personal information may be directed to:

Email: contact@treasurewelllaw.co.uk

Updates

Treasure Well reserves the right to amend or update this Statement from time to time to reflect changes in applicable laws, technology, or business operations.