Privacy Notice
Last reviewed 11 July 2026
Thank you for visiting the website of Compufile Systems Ltd (“CSL”, “we”, “us” or “our”).
This Privacy Notice explains how we collect and use personal data:
- When you visit our website
- When you contact us
- In connection with our relationships with customers, suppliers, prospective customers and other business contacts
- Where we otherwise process personal data for our own business purposes or to comply with legal and regulatory requirements
Please read this Privacy Notice before submitting personal data to us.
We may update this Privacy Notice from time to time to reflect changes to our processing activities, legal requirements or business practices. Any updated version will be published on this website. Changes will apply from the date on which the updated notice is published and will not apply retrospectively.
This Privacy Notice applies to CSL’s own processing of personal data. It does not apply to third-party websites that you may access through links on our website. You should review the Privacy Notice of any third-party website before providing personal data to it.
If you use one of CSL’s services, are a customer or supplier of CSL, you can see how we use your data from that service by clicking on the relevant link below:
CSL also process pseudonymised information from NHS England’s Hospital Episode Statistics data set. To see more information about our processing of these data, click here.
who we are
CompuFile Systems Limited registered in England No 02289762. For the purposes of the UK GDPR, we are a controller and are registered with the Information Commissioner’s Office number Z6752202.
how to contact us
Compufile Systems Limited
The Sussex Barn
Paper Harow Park
Godalming
Surrey
GU8 6BQ
Email: info@csl-uk.com
Phone: +44 (0) 1483 528 300
Where we act as PROCESSOR
In some circumstances, CSL processes personal data on behalf of other organisations, and only in accordance with that organisation’s instructions. In these circumstances, the other organisation is the controller and is responsible for deciding how and why your personal data is processed.
Our service-specific processor Privacy Notices explain the relevant processing activities. You can view these notices using the links below:
If you have any questions, complaints or wish to exercise any your data protection rights, where CSL is acting a processor, you should contact the controller. The controller is the organisation that instructed CSL to process your personal data.
If you contact CSL directly about processing we carried out on behalf of a controller, we will be unable to deal with your enquiry. We may refer or forward your enquiry or request to that organisation so that it can respond.
Personal data we process
We may process personal data about visitors to our website and individuals who work for, or represent, customers, suppliers, prospective customers, business partners and industry organisations.
The personal data we collect may include:
- Your name
- Your work email address
- Your business telephone and fax number
- Your job title
- The name and address of your organisation
- Any personal data you choose to include in the subject or message fields of our website contact form, or correspondence between us
- CCTV footage captured in designated areas of CSL’s premises, including entrances, exits and areas in which highly restricted assets are stored.
Where you submit an enquiry through our website, we will use the information you provide to respond and manage your request. We will only use that information for another purpose, such as adding you to a mailing list, where we have an appropriate lawful basis for doing so.
CSL also holds limited business contact information relating to individuals with which we are currently engaged or have had dealings with during the previous three years.
How we use your data and our lawful bases
We use the personal data submitted through the contact form on our website to respond to your enquiry and manage any related follow-up correspondence.
Lawful basis: Our legitimate interests in responding to enquires, communicating with prospective customers and developing our business relationships.
Where your enquiry relates to entering into a contract with you, we may instead rely on taking steps at your request before entering into a contract.
We you are a customer, supplier, prospective customer or other business contact, we may use your personal data to:
- Communicate with you about the relevant products or services
- Keep you informed of progress
- Provide, administer and support our services
- Manage our contractual and commercial arrangements
- Maintain contact for the duration of our working relationship
Lawful basis: where you personally party to a contract with CSL, the processing may be necessary to enter into or perform that contract.
Where you are acting on behalf of a customer, supplier or other organisation, we rely on our legitimate interest in providing our services, managing our commercial relationships and operating our business effectively.
Complying with our legal and regulatory obligations
We may use and retain personal data where necessary to comply with legal, regulator, accounting, taxation, fraud detection and prevention and recording keeping requirements, or to establish, exercise or defend a legal claim.
Lawful basis: Compliance with a legal obligations to which CSL is subject. Where the processing is not required by law, we may rely on legitimate interests in protecting our business and legal rights.
Misuse and fraud detection
We process personal data to protect our services, investigate misuse, detect and prevent fraud and to maintain the security of our services.
Lawful basis: Our legitimate interest in protecting our systems, our users and our customers.
Marketing and service updates
We may use your contact details to send you newsletters and information about products, services or developments that we believe may be relevant to you or your organisation.
Lawful basis: Your consent where consent is required or where you have specifically agreed to receive marketing communications. Where we are permitted to send business-to-business marketing without consent, we may rely on our legitimate interests in promoting and developing our products and services.
You can withdraw your consent or object to receiving marketing communications at any time by using the unsubscribe option included in the communication or by contacting us. Withdrawing your consent will not affect the lawfulness of any processing carried out before it was withdrawn.
data retention
Personal data relating to customers, suppliers and contacts at industry organisations is retained for the duration of our relationship with the relevant organisation and for three years after that relationship ends, after which, it will be securely deleted or anonymised unless a longer retention period is required.
Where personal data is contained in contracts, invoices, payment records or other accounting or taxation records, we will generally retain those records for six years from the end of the accounting year to which they relate. We may retain records for longer where required by law, where HMRC or another regulatory authority is conducting an enquiry, where we are required to do so for insurance purposes or where the records are required in connection with a legal dispute.
Personal data submitted through our website contact form is normally retained for up to twelve months after we have responded to and completed any follow-up relating to your enquiry. Where the enquiry leads to a business relationship, the retention period applying to customers, supplier or other business contact will apply.
CCTV footage is normally retained for two weeks. It may be retained longer where it is required to investigate an incident, respond to a complaint, support legal proceedings or meet a legal or regulatory obligation.
If you opt out of marketing or optional update emails, we may keep limited information, such as your email address and marketing preferences to record your choice and make sure we do not contact you again for that purpose.
International data transfers
We do not routinely transfer your personal data outside of the UK or EEA. Our core systems, including Microsoft 365, are configured to use UK data centre locations where available.
However, some third-party service providers, suppliers or processors who process personal data on our behalf may process, access or transfer personal data outside of the UK and/or the EEA. Where this happens, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws. These may include adequacy regulations, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses together with the UK Addendum.
Sharing personal data
Where you use the KPID service, we may share relevant personal data with your organisation and the department that commissioned the service, where necessary, to provide the service and report on its delivery.
We may also share personal data with:
- Service providers acting on our behalf, including IT, hosting and communication providers such as Microsoft 365
- Our professional advisers and legal representatives
- Regulators, law enforcement agencies, government bodies and other public authorities where required or permitted by law
- Organisations assisting with fraud prevention, detection and investigation
We only share personal data where necessary and appropriate for the relevant purpose. Service providers acting as processors may use personal data only in accordance with our written instructions and contractual requirements.
We do not share personal data with these organisations for their own marketing purposes.
Commitment to data security
Your personally identifiable information is kept secure. Only authorised employees, agents and contractors (who have agreed to keep information secure and confidential) have access to this information.
We take data security very seriously and are ISO27001 certified.
Your Data Protection Rights
The data protection regulations and UK law seeks to protect your rights as follows:
The right to be informed
Individuals have the right to be told what personal data is collected about them, why, who is collecting the data, how long it will be held, how they can file a complaint and with whom your data will be shared.
The right of access
Individuals have the right to access the personal information and organisation holds about them. To request a copy of this information you must make a subject access request by contacting us using the contact details above.
The right of rectification
Individuals may ask an organisation to correct any inaccurate or incomplete data within one month.
The right to erasure
Individuals have the right to have your personal data erased and to prevent processing except where we have a legal obligation to process your personal information. You should bear in mind that by exercising this right you may hinder or prevent our ability to provide products and services.
Right to restrict processing
Individuals can request that an organisation limits the way it uses their personal data. This means that an organisation is not obligated to delete the data, but they must refrain from processing it.
The right to data portability
On your request, we will provide you with your personal data in a structured format.
The right to object
Allows individuals to object to the processing of personal data at any time, in certain situations and will depend on the purpose of processing and the lawful basis for processing.
Rights in relation to automated decision making and profiling
You have particular rights in relation to automated decision making and profiling to reduce the risk that a potentially damaging decision is taken without human intervention. You can object to your personal data being used for profiling, direct marketing or research purposes.
You may exercise any of your data protection rights at any time by contacting us at info@csl-uk.com.
Please note that your data protection rights are not absolute. Whether a particular right applies will depend on the lawful basis on which we process your personal data, the purpose for which it is processed and any legal or regulatory obligations that apply to us.
Where you exercise a data protection right, we will consider your request in accordance with applicable data protection law. Where we are unable to comply with your request, or can company only in part, we will explain the reason for our decision.
Where we rely on consent for optional service alerts, marketing or newsletters, you may withdraw your consent or unsubscribe at any time to info@csl-uk.com. This will not affect processing carried out before consent was withdrawn or any processing based on another lawful basis and may result in CSL being unable to continue to provide the relevant service.
Where CSL processes your personal data on behalf of another organisation, that organisation is the controller. You should direct any request to exercise data protection rights to the controller, although we will assist where required.
Cookie/Tracking Technology
The Site may use cookie and tracking technology depending on the features offered. Cookie and tracking technology are useful for gathering information such as browser type and operating system, tracking the number of visitors to the Site, and understanding how visitors use the Site. Cookies can also help customise the Site for visitors. Personal data cannot be collected via cookies and other tracking technology, however, if you previously provided personally identifiable information, cookies may be tied to such information. Aggregate cookie and tracking information may be shared with third parties.
how to complain
Please let us know if you are unhappy with how we have used your personal data. You can contact us in the first instance using the Privacy Contact Information below. We will try to resolve the matter to your satisfaction.
Should you remain dissatisfied after receiving our response, you also have the right to complain to the Information Commissioner’s Office. Find out on their website how to report a concern, https://ico.org.uk/.
privacy contact information
If you have any questions, concerns, or comments about our privacy notice you may contact us (the data controller) using the information below:
By email: info@csl-uk.com
By Phone: +44 (0) 1483 528 300
By Mail: Data Protection Officer, CSL, The Sussex Barn, Peper Harow Park, Godalming, Surrey, GU8 6BQ
We reserve the right to make changes to this policy. Any changes to this policy will be posted on our website.
Last reviewed July 2026