Data Protection Policy
Last updated: 4 October 2026
1. Policy Overview
This Data Protection Policy explains how Defence Legal Services Ltd protects personal data processed through PoliceStationRepUK.
This policy supplements our Privacy Policy and GDPR Policy.
2. How we protect your data
Police Station Rep UK is run by a small team. We use established cloud providers and keep our own controls simple and proportionate:
- Hosting and transport security. The site is hosted on Vercel. All traffic uses HTTPS (TLS), and our domain is on the HSTS preload list. We set standard browser security headers (Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy).
- Storage. Directory and account data is stored with Upstash (Redis), which encrypts data at rest. Our hosting and storage providers maintain their own independent security certifications.
- Access. Only named administrators can reach admin tools. Administrators and representatives sign in with a single-use code sent to their registered email address. Codes expire after 10 minutes and allow a limited number of attempts. Admin sessions expire after 1 hour.
- Abuse protection. We rate-limit sign-in, registration, contact-detail requests and reports, and use Cloudflare Turnstile on some forms.
- Private fields stay private. Verification details (such as PIN or SRA checks and any proof you upload) are never published. They are visible only to administrators.
- Logging. Our hosting provider keeps request and error logs for a limited period. We record admin review decisions against each listing.
- Breaches. If we discover a personal data breach, we assess it promptly. Where required, we notify the ICO within 72 hours and tell affected people without undue delay.
3. How long we keep data
| Data | Kept for |
|---|---|
| Live directory listing | While you are listed, with annual re-verification |
| Listing and account you ask us to remove | Deleted within 30 days of your request |
| Applications not approved, or flagged for possible impersonation or fraud | As long as needed to protect the directory and deal with any dispute |
| Payment and tax records | Up to 7 years (accounting and tax law) |
| Hosting request and error logs | Our hosting provider's standard period |
| Rate-limit counters | Expire automatically (typically minutes to a day) |
Our Privacy Policy has the full retention details.
4. Service providers (processors)
Hosting
Vercel
Website hosting and request logs (may involve US processing)
Database
Upstash (Redis)
Directory and account data; encrypted at rest by the provider
Resend
Transactional and operational email
Payments
Lemon Squeezy
Featured listing payments (merchant of record)
Bot protection
Cloudflare Turnstile
Bot and abuse checks on some forms
AI answers
OpenAI
Only where the guided assistant's AI answer feature is switched on
These providers process data on our instructions under their standard data processing terms. Some are based in, or process data in, the United States; where that happens we rely on UK transfer safeguards (the UK IDTA / Addendum and/or the UK extension to the EU–US Data Privacy Framework, as applicable). We do not use Google Analytics or advertising cookies.
5. Contact and Complaints
For data protection enquiries or concerns:
Email: robertcashman@defencelegalservices.co.uk
Subject: “Data Protection Enquiry”
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
Have a data protection concern? Contact us and we'll respond promptly.