2. What Data We Collect and Why

Enquiry and contact data — When you contact us via our website contact form, email, or telephone, we collect your name, email address, telephone number, and any information you provide about your device or recovery case. This is used to respond to your enquiry and manage your recovery case.

Recovery case data — When you instruct us to carry out a recovery, we collect and retain details relating to your case including device information, fault description, communication history, quotations, and payment records. This data is necessary to fulfil our contract with you.

Website usage data — We use Google Analytics to collect anonymous information about how visitors use our website, including pages visited, time spent on the site, and referring sources. This data does not identify you personally and is used to improve our website and services.

Cookies — Our website uses cookies to function correctly and to support analytics. You can control cookie settings through your browser. Continued use of our website constitutes acceptance of our cookie policy.

Marketing communications — If you have opted in to receive communications from us, we may contact you with relevant service updates or information. You can unsubscribe at any time by contacting us at info@dragondatarecovery.co.uk or by using the unsubscribe link in any marketing email.

3. The Legal Basis for Processing Your Data

We process your personal data on the following legal grounds under UK GDPR:

• Contract performance — to fulfil our recovery service agreement with you
• Legitimate interests — to manage and improve our business operations and website
• Legal obligation — to comply with applicable laws and regulations
• Consent — where you have explicitly opted in to marketing communications

4. How We Handle Data on Your Devices

This section is specific to our data recovery service and is important.

When your device arrives at our laboratory, it may contain personal, confidential, or sensitive data belonging to you or third parties. We treat all such data with the strictest confidentiality.

Sight-unseen processing — By default, all recovery work is carried out without our staff browsing, opening, or inspecting the contents of your files. Your data is imaged, processed, and transferred without manual review of file content.

File verification — If you specifically request that we verify the presence or condition of particular files (such as specific folders, documents, or photos), we will make reasonable efforts to assist. We are unable to manually verify large datasets on a file-by-file basis as this falls outside the scope of standard recovery.

Data retention on recovered media — Any temporary recovery data held on our systems is permanently and securely deleted within 14 days of your data being delivered or dispatched to you.

Physical media — Faulty drives, donor parts, and other physical components are securely destroyed or recycled in accordance with data protection requirements, unless returned to you as part of a declined recovery.

Third-party data — If the device you submit belongs to or contains data relating to a third party (for example, a business device or a device belonging to a client of yours), it is your responsibility to ensure you have the appropriate authority to instruct us to process that device.

5. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We may share your data with the following categories of third parties where necessary to deliver our service:

Courier services (UPS, DHL, Royal Mail) — for the collection and return of devices and recovered data

Payment processors — to process recovery fees securely

IT and software providers — who support our ticketing, case management, and communication systems, under appropriate data processing agreements

Google Analytics — for anonymous website usage data

All third parties we work with are required to handle your data securely and in accordance with applicable data protection law.

We may also disclose your data where required to do so by law, regulation, or court order.

6. How Long We Keep Your Data

We retain personal data and recovery case records for a period of six years following completion of your case, in line with our legal and contractual obligations under UK law.

Website analytics data is retained in accordance with Google Analytics default retention settings.

Marketing contact data is retained until you unsubscribe or request removal.

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restrict processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a portable format where applicable
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at info@dragondatarecovery.co.uk. We will respond within one calendar month.

8. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

ICO website: www.ico.org.uk
ICO helpline: 0303 123 1113

We would, however, welcome the opportunity to address your concerns directly before you contact the ICO, so please get in touch with us first.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most current version will always be available on our website. The date at the top of this page indicates when it was last updated.

10. Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or your personal data, please contact us at:

Dragon Data Recovery Ltd.
28b Tarran Way West
Tarran Industrial Estate
Wirral
Merseyside
CH46 4TT

Email: info@dragondatarecovery.co.uk

Telephone: 0151 342 8188