Trust Centre

Certifications

ISO 9001

Certificate Number: 163952009

Standard: ISO 9001:2015

Scope: THE PROVISION OF DATA MANAGEMENT AND RELATED SERVICES.

Issue Date: 07/10/2025

Expiry Date: 06/10/2028

Issuing body: Citation ISO Certification

Location: London

ISO 14001

Certificate Number: 163972009

Standard: ISO 14001:2015

Scope: THE PROVISION OF DATA MANAGEMENT AND RELATED SERVICES.

Issue Date: 07/10/2025

Expiry Date: 06/10/2028

Issuing body: Citation ISO Certification

Location: London

ISO 27001

Certificate Number: 175632020

Standard: ISO/IEC 27001:2022

Scope: THE PROVISION OF DATA MANAGEMENT AND RELATED SERVICES

Issue Date: 29/10/2026

Expiry Date: 28/10/2029

Issuing body: Citation ISO Certification

Location: London

Cyber Essentials

Certificate ID: c8d5bfb8-1f5e-465c-9890-502d7e957974

Issue Date: 24/06/2026

Expiry Date: 24/06/2027

Issuing body: Citation Cyber

NHS Data Security and Protection Toolkit (DSPT)

Organisation code: 8K949

Current Status: 2025-26 (version 8) – Standards exceeded

Date Published: 28/03/2026

ICO Registration

Registration reference: Z1990032

Date registered: 03/02/2010

Registration expires: 02/02/2027

Issued by: Information Commissioner’s Office

How We Process Your Data

When we store, scan, host or destroy records for you, you remain in control of your data. Under UK data protection law, you’re the controller and we’re the processor. Our data processing terms, which form part of every client agreement, set out exactly what we commit to. This page summarises them.

We act only on your instructions

We process your data only to provide the services you’ve asked for, and only on your documented instructions. We never sell your data, use it for our own purposes or combine it with other data. If we think an instruction would breach data protection law, we’ll tell you.

Our people are bound by confidentiality

Everyone who handles your records is bound by confidentiality and screened before they join us. Access is limited to those who need it, and staff receive data protection training at induction and at least once a year.

Your data is protected to recognised standards

We hold ISO 27001, ISO 9001 and ISO 14001 certification, Cyber Essentials, and the NHS Data Security and Protection Toolkit. Secure destruction is carried out to BS EN 15713. Our security measures include:

• Controlled access, intruder alarms, CCTV and fire protection at our storage facilities.
• Tracked vehicles, sealed containers, vetted drivers and chain-of-custody records for every collection.
• Role-based access, multi-factor authentication and encryption in transit and at rest for digital files.
• Audit trails, tested backups, business continuity planning and annual penetration testing.

Your data stays with us, in the UK

We don’t use sub-processors, and we don’t transfer your data outside the United Kingdom. If that ever changes, we’ll give you at least 14 days’ written notice. That notice will say who the new provider is, what they’ll do and where. You can object, and if we can’t resolve your concern within 30 days, you can end the affected services without penalty. We’ll also keep the list at https://www.dajon.co.uk/trust/ up to date.

We help you meet your obligations

• Data subject requests: If someone contacts us about their data, we’ll pass the request to you within 5 working days. On your instruction, we’ll locate, retrieve, correct or destroy the relevant records within 10 working days.
• Breaches: If a breach affects your data, we’ll notify you within 48 hours.
• Compliance: We’ll support your data protection impact assessments and any consultation with the ICO.

You can check our compliance

We’ll provide the information you need to show that we meet our obligations, including our certifications. You can also audit us once a year on 30 days’ notice, or at any time following a breach or at a regulator’s request.

Your data is returned or destroyed when we finish

When our services end, you choose whether we return your records or securely destroy them. We’ll provide a certificate of destruction for every batch destroyed.

Questions

To request a copy of our full data processing terms or ask about how we handle your data, contact us at info@dajon.co.uk or on 020 7732 3223.

This summary is for information only. If it differs from the data processing terms in your agreement with us, the agreement applies.

Business Continuity and Disaster Recovery

We plan for disruption, so that your records and the services you rely on stay protected and available. We keep a business continuity plan and back up the digital data we hold for you. We test our restore procedures, so we know we can recover your data if something goes wrong. Our storage facilities have fire detection and suppression, intruder alarms and CCTV. Our continuity and security arrangements are reviewed regularly as part of our ISO 27001 certification.

Secure Destruction and Chain of Custody

Your records are accounted for at every step, from the moment we collect them to the moment they’re destroyed or returned to you.

• Collection and transport: We use tracked vehicles, sealed containers and vetted drivers. Every collection is recorded in a chain-of-custody record.
• Storage and retrieval: Our audit trails record every retrieval and every access to our systems, so we can show who handled your records and when.
• Destruction: We destroy records to BS EN 15713, the standard for secure destruction of confidential material, and you receive a certificate of destruction for every batch.
• At the end of our services: You choose whether we return your records or securely destroy them.

Breach Notification

If a breach ever affects your data, we’ll tell you quickly so you can meet your own legal deadlines. We’ll notify you without undue delay, and within 48 hours of becoming aware of it at the latest. That leaves you time to report to the ICO within the 72 hours UK GDPR allows. Our notification will cover, as far as we know them at the time:

• What happened, including the types and approximate number of people and records affected.
• The likely consequences.
• What we’ve done, or plan to do, to contain the breach and limit its effects.
• Who to contact at Dajon for more information.

We’ll share further details as our investigation progresses. Because it’s your data, we won’t notify the ICO or the people affected without your agreement, unless the law requires us to. We’ll also help you with any notifications you need to make.