Privacy Policy Supplement — EU & UK Data Subjects
Version 1.0 | Effective Date: 07/01/2026
1. Scope and Applicability
This Addendum supplements our main Privacy Policy and applies specifically to personal data processed in relation to individuals located in the European Economic Area (EEA) and the United Kingdom (UK). It is intended to satisfy the requirements of the EU General Data Protection Regulation (GDPR) (Regulation 2016/679) and the UK General Data Protection Regulation (UK GDPR) as retained under the UK Data Protection Act 2018.
Where this Addendum conflicts with the main Privacy Policy, this Addendum takes precedence in relation to EU and UK data subjects.
2. Data Controller Identity and Contact Details
The data controller responsible for your personal data is:
Primary Solutions
2780 Airport Dr, Suite 130
Columbus, OH, 43219
United States of America
Email: info@primarysolutions.com
3. Legal Bases for Processing
We process personal data only where we have a valid legal basis under Article 6 GDPR / UK GDPR. The table below sets out each processing activity, the data involved, our purpose, and the applicable legal basis.
| Processing Activity | Categories of Data | Purpose | Legal Basis (Article 6) |
| Website analytics (Google Analytics) | IP address, device/browser data, pages visited, session data | Understand site usage and improve performance | Consent — Art. 6(1)(a). Data collected only after analytics cookies are accepted. |
| Enquiry and contact form submissions | Name, email, message content | Respond to enquiries and service requests | Legitimate interests — Art. 6(1)(f). Necessary to respond to a contact initiated by the data subject. |
| Client onboarding and service delivery | Name, contact details, billing information, project data | Perform the contract for services | Contract — Art. 6(1)(b). Processing is necessary to fulfil the service agreement. |
| Marketing communications | Name, email address | Send promotional content, newsletters, updates | Consent — Art. 6(1)(a). Subscribers may withdraw at any time via unsubscribe link. |
| Legal and regulatory compliance | Any data necessary to comply with applicable law | Meet legal obligations (e.g. tax, anti-fraud) | Legal obligation — Art. 6(1)(c). |
| CRM and client relationship management | Name, email, company, communication history | Manage ongoing client relationships | Legitimate interests — Art. 6(1)(f). We have a legitimate interest in maintaining client records. |
Where processing is based on legitimate interests (Art. 6(1)(f)), we have conducted a balancing test and determined that our interests are not overridden by your rights and freedoms. You have the right to object to such processing at any time (see Section 6).
4. International Data Transfers
We are a US-based organisation that also has EU/UK presence. Some of our operations and third-party service providers involve the transfer of personal data to countries outside the EEA and UK, including the United States. We ensure all such transfers are protected by appropriate safeguards as required under Chapter V GDPR and UK GDPR.
4.1 Transfer Mechanisms
Standard Contractual Clauses (SCCs) — EU Transfers
For transfers from the EEA to third countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (SCCs) issued under Commission Implementing Decision (EU) 2021/914. These clauses are incorporated into our data processing agreements with relevant processors and controllers.
UK International Data Transfer Agreement (IDTA)
For transfers from the UK, we rely on the UK International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner’s Office (ICO) under Section 119A of the Data Protection Act 2018, or the UK Addendum to the EU SCCs where applicable.
EU–US Data Privacy Framework
Where a US recipient is certified under the EU–US Data Privacy Framework (DPF), recognised by adequacy decision on 10 July 2023, we may rely on that framework as the transfer mechanism. [Update as applicable to your specific processors.]
4.2 Third-Party Processors Involving International Transfers
| Processor / Service | Country of Processing | Data Categories | Transfer Mechanism |
| Google LLC (Google Analytics / GTM) | United States | Pseudonymous analytics data, IP addresses | EU SCCs (Module 2: Controller to Processor) + EU–US DPF where applicable. GA data collection gated behind analytics consent. |
| [CRM / Email Platform e.g. HubSpot, Mailchimp] | United States | Name, email, communication history | EU SCCs (Module 2: Controller to Processor) / UK IDTA. Data Processing Agreement in place. |
| [Cloud Hosting / Infrastructure e.g. AWS, GCP] | United States / Global | Any data stored on or transmitted via hosted infrastructure | EU SCCs (Module 2) + supplementary technical measures (encryption at rest and in transit). UK IDTA where applicable. |
| [Other Third-Party Tools] | [Country] | [Categories] | [SCCs / IDTA / DPF — update as applicable] |
You may request a copy of the applicable transfer mechanism documentation by contacting us at [privacy@yourdomain.com].
4.3 Supplementary Technical Measures
In addition to legal safeguards, we implement the following technical measures to protect personal data in transit and at rest:
- TLS 1.2+ encryption for all data in transit
- Encryption at rest for stored personal data
- Pseudonymisation where operationally feasible
- Access controls and least-privilege principles for staff accessing personal data
5. Retention Periods
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
| Data Category | Retention Period | Rationale |
| Website analytics data | 14 months (GA4 default) | Configured in GA4 data retention settings; anonymised aggregates may be retained longer. |
| Contact / enquiry form submissions | 3 years from last contact | Legitimate interests in maintaining enquiry history and handling potential disputes. |
| Client project and contract data | 7 years from contract end | Statutory requirement for financial and tax records. |
| Marketing email lists | Until consent is withdrawn or 2 years of inactivity | Consent-based processing; data suppressed upon unsubscribe. |
| Data subject rights requests | 3 years from resolution | Demonstrate compliance with regulatory obligations. |
6. EU and UK Data Subject Rights and Request Procedures
Under the GDPR and UK GDPR, individuals located in the EEA and UK have the following rights in relation to their personal data. We take all requests seriously and will respond within the statutory timeframe.
6.1 Your Rights
Right of Access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is used, where it is stored, and with whom it is shared.
Right to Rectification (Article 16)
You have the right to request correction of inaccurate or incomplete personal data we hold about you. We will action this without undue delay.
Right to Erasure / ‘Right to be Forgotten’ (Article 17)
You may request deletion of your personal data where: the data is no longer necessary; you withdraw consent (where processing was consent-based); you object and we have no overriding legitimate grounds; the data was unlawfully processed; or deletion is required to comply with law.
Right to Restriction of Processing (Article 18)
You may request that we limit how we use your data in certain circumstances, including while we verify the accuracy of data you have contested, or while we assess an objection you have raised.
Right to Data Portability (Article 20)
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
Right to Object (Article 21)
You have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f)) or for direct marketing purposes. On receipt of an objection to direct marketing, we will cease processing immediately. For other objections, we will cease unless we can demonstrate compelling legitimate grounds.
Rights Related to Automated Decision-Making (Article 22)
We do not currently carry out solely automated decision-making, including profiling, that produces legal or similarly significant effects. If this changes, we will update this Addendum and provide appropriate safeguards.
Right to Withdraw Consent (Article 7(3))
Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw analytics cookie consent via the cookie preference centre on our website.
6.2 How to Submit a Data Subject Request
To exercise any of the rights above, please submit your request using one of the following methods:
- Email: [privacy@yourdomain.com] — Subject line: “Data Subject Request”
- Postal address: [Company Name, Data Protection, Full Address]
- Online form: [link to DSR form if available]
To protect your data, we may need to verify your identity before processing your request. We will ask for sufficient information to confirm you are the data subject or an authorised representative.
6.3 Response Timelines
| Request Type | Standard Deadline | Extension |
| All data subject rights requests | One calendar month from receipt | May be extended by a further two months for complex or numerous requests. We will notify you within the first month if an extension applies and explain the reason. |
| Requests received electronically | Response provided electronically where possible | Unless you request otherwise. |
We will not charge a fee for handling requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to comply.
6.4 Right to Lodge a Complaint
If you are dissatisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with your relevant supervisory authority:
- EU residents: The data protection authority in your EU member state of habitual residence, place of work, or the location of the alleged infringement. A full list of EU supervisory authorities is available at: edpb.europa.eu
- UK residents: The Information Commissioner’s Office (ICO) — ico.org.uk — 0303 123 1113
We encourage you to contact us first so we have the opportunity to address your concerns directly.
7. Cookies and Consent Management
Our use of cookies is governed by Google Consent Mode v2 and our CookieYes consent management platform. Non-essential cookies, including analytics cookies (Google Analytics), are not set until you provide explicit consent. You can manage, update, or withdraw your cookie consent at any time via the cookie preference centre accessible from the footer of our website.
For a full list of cookies we use, their purposes, providers, and retention periods, please visit our Cookie Policy.
8. Updates to This Addendum
We review this Addendum periodically and will update it when our processing activities or applicable law changes. Material changes will be communicated to EU/UK data subjects via email or a prominent notice on our website. The “Effective Date” at the top of this document reflects the most recent version.
9. Contact
For any questions about this Addendum or our data protection practices, contact:
Primary Solutions
2780 Airport Dr, Suite 130
Columbus, OH, 43219
United States of America
Email: info@primarysolutions.com
