Data Processing

Controller and processor roles

For our own contact, enquiry, and business records, Selador Group acts as the data controller and decides why and how data is processed.

Where a client engages us to prepare open-source research, we decide what to collect from publicly available sources and how to present it, so for that compilation we act as the controller. Once we deliver the research to the client, the client becomes the controller. We are not joint controllers, and we do not run a public database. Our Privacy Policy and our Sourcing and Responsible Use policy explain how we handle this information.

Where we handle personal data on a client’s behalf as part of delivering a project, we act as a processor and follow the client’s documented instructions. The client remains the controller for that data.

Scope and instructions

When we act as a processor, the subject matter, duration, nature, and purpose of the processing, and the categories of data and individuals, are set out in the relevant engagement.

When we act as a processor, we process such data only on the client’s instructions, keep it confidential, and do not use it for our own purposes beyond what is needed to deliver the agreed work.

Subprocessors and security

We may use trusted subprocessors, such as hosting and email providers, under written terms that require appropriate protection. A current list is available on request, and we tell affected clients before adding new ones where required.

We apply appropriate technical and organisational measures to protect data, and we assist clients with their own obligations, including responding to data-subject requests and reporting incidents.

Return, deletion, and a formal DPA

On the end of an engagement, we return or delete personal data processed on the client’s behalf, subject to any retention required by law.

Where a client needs a formal data processing agreement to sit alongside our Terms, we are happy to enter one. Contact [email protected] to arrange it.