Data Protection & GDPR

Streets Heaver Computer Systems – Statement of Compliance

Our commitment to data protection

Streets Heaver Computer Systems Ltd is committed to maintaining high standards of data protection, information security and privacy.

We maintain appropriate technical and organisational measures designed to support compliance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

Our approach is supported by independently certified and assessed frameworks, including:

• ISO/IEC 27001 – Information Security Management, providing a structured, risk-based framework for protecting the confidentiality, integrity and availability of information.
• ISO/IEC 27701 – Privacy Information Management, extending our information security management framework to support the effective management of personal information and our privacy responsibilities.
• Cyber Essentials Plus, providing independent technical verification of key cyber security controls designed to protect against common cyber threats.

Together, these frameworks support our integrated approach to privacy, data protection and information security, helping us protect the information entrusted to us and provide assurance to our customers.

Protecting personal data

As a provider of healthcare software and hosted services, we recognise the importance of protecting the personal data entrusted to us and our customers. 

Where Streets Heaver acts as a data processor, we process personal data in accordance with applicable data protection requirements, our contractual obligations and the documented instructions of our customers. 

Our data protection and security framework includes controls relating to: 

• access control and information security; 

• privacy and data protection risk assessment; 

• Data Protection Impact Assessments (DPIAs); 

• incident and personal data breach management; 

• data retention and secure disposal; 

• backup, resilience and business continuity; 

• supplier and sub-processor management; 

• international data transfers, where applicable; and 

• employee data protection and security awareness training. 

Our software and services

Our healthcare software and hosted services include functionality designed to assist customers in meeting their data protection obligations, including the management, retrieval, rectification, restriction, export, anonymisation and, where appropriate, deletion of personal data. 

Where our customers act as data controllers, they remain responsible for their controller obligations, including establishing the purposes and lawful basis for processing, appropriate retention requirements and responding to individuals exercising their data protection rights. 

Data processing and assurance

Where Streets Heaver processes personal data on behalf of a customer, appropriate data protection provisions are incorporated into our contractual arrangements. 

Customers undertaking due diligence, procurement, DPIAs or information governance and security assessments can contact us to request relevant data protection, privacy and information security assurance information.

Contact us

To request a copy of our Data Protection Impact Analysis Summary please e-mail:
Email Us

For questions about data protection, privacy or how Streets Heaver processes personal data, please contact: 

David Skinner
Compliance Manager and Data Protection Officer
Streets Heaver Computer Systems Ltd
compliance@streets-heaver.com 

Further guidance is available from the Information Commissioner’s Office and NHS Data Security and Information Governance. 

Last updated: 27/10/26