Privacy Policy

Introduction

EL ROI FORTRESS ACQUISITIONS LTD ("ERFA", "we", "us", "our") understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits www.el-roifortress.co.uk and will only collect and use personal data in ways that are consistent with our obligations and your rights under the UK General Data Protection Regulation (UK GDPR) 2018.

ERFA is the data controller and is registered with the Information Commissioner's Office (ICO) under registration number ZC100671.

Roles and Responsibilities

ERFA's Data Protection Officer (DPO) is:

• Name: Kingsley Ayalogu (Director)
• Email: contact@el-roifortress.co.uk
• In Writing: 167-169 Great Portland Street, London, England, W1W 5PF

By using this website, you are deemed to have accepted this Privacy Policy. If you have any concerns about how we handle your data, you may make a complaint to the Information Commissioner's Office at www.ico.org.uk.

Summary

ERFA will at all times:

1. Be transparent about: (i) what information we collect; (ii) why we collect it; (iii) how it is stored; (iv) where it is stored; (v) what we do with it; (vi) when it is disposed of; and (vii) how it is disposed of.
2. Have measures in place to protect your personal data.
3. Respect your rights under UK GDPR and give you control over your data.
4. Cease communication with you if you request us to do so.

1. The Data Protection Principles

In accordance with UK GDPR, all personal data must be:

1. Processed lawfully, fairly and transparently;
2. Collected for specified, explicit and legitimate purposes;
3. Adequate, relevant and limited to what is necessary for those purposes;
4. Accurate and, where necessary, kept up to date;
5. Kept in a form which permits identification for no longer than is necessary; and
6. Processed in a manner that ensures appropriate security of the personal data.

2. Lawful, Fair and Transparent Data Processing

Processing of personal data is lawful if at least one of the following applies:

1. The data subject has given consent to the processing.
2. Processing is necessary for the performance of a contract to which the data subject is party.
3. Processing is necessary for compliance with a legal obligation.
4. Processing is necessary to protect the vital interests of the data subject or another person.
5. Processing is necessary for the performance of a task carried out in the public interest.
6. Processing is necessary for the purposes of legitimate interests pursued by ERFA or a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject.

3. Processed for Specified, Explicit and Legitimate Purposes

3.1 ERFA collects personal data as set out in Section 20 of this Policy.

3.2 The purposes for which we process personal data are provided to data subjects via our website Privacy Policy and Cookie Policy, either at the time of collection or within one calendar month. A link to our Privacy Policy is available at the bottom of www.el-roifortress.co.uk.

4. Adequate, Relevant and Limited Data Processing

ERFA will only collect and process personal data to the extent necessary for the specific purpose for which it was collected. We do not collect personal data beyond what is required.

5. Accuracy of Data and Keeping Data Up to Date

Personal data shall be kept accurate and up to date. Accuracy is checked at the time of collection and reviewed every 12 months thereafter. Inaccurate or incomplete data will be erased or rectified without undue delay.

6. Data Retention

Personal data will not be kept longer than is necessary for the purposes for which it was collected. When data is no longer required, all reasonable steps will be taken to erase it without undue delay. Further details are set out in our Data Retention Policy.

7. Secure Processing

All personal data held by ERFA is kept secure against unauthorised or unlawful processing and accidental loss, destruction or damage. Further details are set out in Sections 22 to 28 of this Policy.

8. Accountability

8.1 ERFA's Data Protection Officer is Kingsley Ayalogu (Director). Contact: contact@el-roifortress.co.uk

8.2 The DPO is responsible for overseeing the implementation of this Policy and monitoring compliance with UK GDPR and other applicable data protection legislation.

8.3 ERFA keeps written internal records of all processing activities, which include:

• The name and contact details of ERFA and the DPO;
• The purposes of the processing;
• A description of the categories of personal data processed;
• Details of any third-party recipients of personal data;
• Details of any transfers of personal data to a third country or international organisation;
• Retention periods for each category of personal data; and
• A description of the technical and organisational security measures in place.

9. Data Protection Impact Assessments

ERFA carries out Data Protection Impact Assessments (DPIAs) for new projects or new uses of personal data where such activities involve new technologies and are likely to result in a high risk to the rights and freedoms of data subjects. DPIAs are overseen by the DPO and address the following:

• The types of personal data being processed;
• The purposes for which the data is processed;
• ERFA's objectives;
• How personal data is and will be used;
• Parties who have been or should be consulted;
• The necessity and proportionality of the processing;
• Risks to data subjects;
• Risks to ERFA; and
• Proposed measures to minimise and address identified risks.

10. The Rights of Data Subjects

Under UK GDPR, data subjects have the following rights:

1. The right to be informed (see Section 11);
2. The right of access (see Section 12);
3. The right to rectification (see Section 13);
4. The right to erasure / right to be forgotten (see Section 14);
5. The right to restrict processing (see Section 15);
6. The right to data portability (see Section 16);
7. The right to object (see Section 17); and
8. Rights in relation to automated decision-making and profiling (see Sections 18 and 19).

11. Keeping Data Subjects Informed

11.1 ERFA shall provide the following information to every data subject when collecting personal data:

1. The identity and contact details of ERFA, including the identity and contact details of the DPO;
2. The purpose(s) for which the personal data is being processed and the legal basis for processing;
3. Where the legal basis is legitimate interests, details of those legitimate interests;
4. Where personal data is not obtained directly from the data subject, the categories of personal data concerned;
5. Details of any recipients or categories of recipients of the personal data;
6. Where applicable, details of any transfers of personal data to a third country and the safeguards in place;
7. The period for which the personal data will be retained;
8. The rights available to the data subject;
9. Where processing is based on consent, the right to withdraw that consent at any time;
10. The right to lodge a complaint with the ICO;
11. Where applicable, details of any statutory or contractual requirement to provide personal data and possible consequences of failing to do so; and
12. Details of any automated decision-making, including meaningful information about the logic involved and the likely consequences of such processing for the data subject.

11.2.1 Where personal data is obtained directly from a data subject, the information above shall be provided at the time the data is collected.

11.2.2 Where personal data is obtained indirectly:

1. If the data is to be used to communicate with the data subject, the information shall be provided at the time of first communication;
2. If the data is to be disclosed to another party, the information shall be provided before the disclosure is made; and
3. In any event, ERFA shall provide the information within one month of obtaining the personal data.

12. Data Subject Access

12.1 Data subjects may make a Subject Access Request (SAR) to ERFA at any time. ERFA will normally respond within one calendar month. This period may be extended by up to two additional months where requests are complex or numerous.

12.2 All SARs received by ERFA shall be forwarded immediately to the DPO: Kingsley Ayalogu (Director) at contact@el-roifortress.co.uk.

12.3 ERFA does not charge a fee for normal SARs. ERFA reserves the right to charge a reasonable fee for additional copies or in cases where requests are manifestly unfounded or excessive.

13. Rectification of Personal Data

13.1 Where personal data held by ERFA is inaccurate or incomplete, it will be rectified and the data subject informed within one calendar month. This period may be extended by up to two months for complex requests.

13.2 Any third parties who received the affected personal data will be informed of any rectification where appropriate.

14. Erasure of Personal Data

14.1 Data subjects have the right to request erasure of their personal data where:

1. The data is no longer necessary for the purpose for which it was originally collected or processed;
2. The data subject withdraws their consent and there is no other lawful basis for processing;
3. The data subject objects to the processing and there is no overriding legitimate interest;
4. The personal data has been processed unlawfully; or
5. Erasure is required to comply with a legal obligation.

14.2 ERFA will comply with a request for erasure and inform the data subject within one calendar month. This period may be extended by up to two months for complex requests.

14.3 Where applicable, any third parties who received the personal data will be informed of the erasure, unless it is impossible or involves disproportionate effort to do so.

15. Restriction of Personal Data Processing

15.1 Data subjects may request that ERFA ceases or restricts the processing of their personal data. Where such a request is received, ERFA will retain only the minimum amount of data necessary to ensure that no further processing takes place.

15.2 Any third parties who received the personal data will be informed of the applicable restrictions, unless it is impossible or involves disproportionate effort to do so.

16. Data Portability

16.1 ERFA processes personal data using the following automated means:

• Microsoft Lists (CRM)
• Microsoft Teams (communication and collaboration)
• Microsoft Forms (onboarding information)
• WordPress (website contact and request forms)
• Xero (invoices for payment)
• Nimbox (encrypted storage for sensitive data)

16.2 Data subjects who have provided personal data on the basis of consent, or where processing is necessary for the performance of a contract, have the right to receive a copy of their personal data in a structured, commonly used and machine-readable format.

16.3 ERFA makes personal data available to data subjects in the following formats:

1. CSV file export;
2. Nimbox access to ERFA Registration Agreements, Documents and Forms; and
3. Word Document copies provided via Nimbox.

16.4 Where technically feasible, personal data may be transmitted directly to another data controller upon request.

16.5 ERFA will comply with data portability requests within one calendar month. This period may be extended by up to two months for complex requests.

17. Objections to Personal Data Processing

17.1 Data subjects have the right to object to the processing of their personal data where ERFA relies on legitimate interests (including profiling) or where data is used for direct marketing purposes.

17.2 Where an objection is received, ERFA shall cease processing unless it can demonstrate compelling legitimate grounds for continuing, or where processing is necessary for the establishment, exercise or defence of legal claims.

17.3 Where a data subject objects to processing for direct marketing purposes, ERFA shall cease such processing immediately and without exception.

18. Automated Decision-Making

18.1 Data subjects have the right to challenge automated decisions that produce a legal or similarly significant effect on them. This includes the right to request human intervention, to express their point of view, and to obtain an explanation of the decision.

18.2 This right does not apply where the automated decision:

1. Is necessary for the entry into or performance of a contract between ERFA and the data subject;
2. Is authorised by applicable law; or
3. Is based on the data subject's explicit consent.

19. Profiling

ERFA does not use personal data for profiling purposes. In the event that profiling were to be introduced, ERFA would ensure the following safeguards are in place:

1. Clear, transparent information is provided to data subjects, including the significance and likely consequences of any profiling;
2. Appropriate mathematical or statistical procedures are used;
3. Technical and organisational measures are implemented to minimise errors and protect the interests of data subjects; and
4. All personal data used for profiling is secured to prevent any discriminatory effects on data subjects.

20. Personal Data Collected, Held and Processed

The following personal data may be collected, held, and processed by ERFA:

21. Marketing Communications

You may receive marketing communications from ERFA if you have:

• Requested information about or purchased our goods or services;
• Completed a "Contact Us" form and indicated that you wish to receive further information; or
• Not previously opted out of receiving marketing communications.

You may opt out of marketing communications at any time by replying "Unsubscribe" to any such communication, or by emailing contact@el-roifortress.co.uk with "STOP" in the subject line.

22. Data Protection Measures

All employees, agents and contractors of ERFA must comply with the following data protection measures:

1. Personal data must not be transmitted automatically by email unless expressly requested by the owner of that data;
2. All emails containing personal data must be marked "Confidential";
3. Personal data must be erased and disposed of securely — hard copies must be shredded; electronic files must be permanently deleted using Microsoft 365 permanent deletion (including deletion from OneDrive/SharePoint and both stages of the Recycle Bin);
4. Personal data must only be transmitted over secure networks;
5. Personal data must not be transmitted over a wireless network if a secure wired alternative is practicable;
6. Personal data transferred via email must be copied to secure storage and the email deleted;
7. All transmitted personal data must be sent using secure, encrypted channels; the recipient must confirm readiness to receive before transmission;
8. All hard copy transfers must be marked "Confidential" and delivered either directly or via Royal Mail with a signature required;
9. Personal data must not be shared informally — access must be formally requested from Kingsley Ayalogu (Director);
10. Hard copies and physical removable media must be stored securely in a locked cabinet or fireproof safe;
11. Personal data must not be transferred without authorisation from Kingsley Ayalogu (Director);
12. Personal data must be handled with care at all times and must not be left unattended or visible to unauthorised parties; and
13. Computer screens containing personal data must be locked whenever the workstation is left unattended.

23. Data Security — Storage

1. Electronic copies of personal data must be stored securely using encrypted, password-protected files on ERFA devices;
2. Hard copies must be stored in a locked filing cabinet; electronic copies on physical or removable media must be stored in a locked fireproof safe;
3. Personal data stored on mobile devices must be protected by a secure password. Such data must be transferred to an encrypted desktop file within 24 hours and deleted from the mobile device thereafter;
4. Personal data must not be transferred to personally-owned devices. Agents and contractors must comply with this Policy in full; and
5. Passwords must be changed regularly and must include a combination of uppercase letters, lowercase letters, numbers and symbols.

24. Data Security — Disposal

Personal data must be erased and disposed of securely when it is no longer required. Further details regarding disposal timescales are set out in our Data Retention Policy.

25. Data Security — Use of Personal Data

25.1 Personal data must not be shared informally. Access must be formally requested from Kingsley Ayalogu (Director), DPO.

25.2 Personal data must not be transferred without authorisation from Kingsley Ayalogu (Director), DPO.

25.3 Personal data must be handled with care at all times and must not be left unattended or visible to unauthorised parties.

25.4 Computer screens containing personal data must be locked whenever the workstation is left unattended.

25.5 Where personal data is used for marketing purposes, Kingsley Ayalogu (Director) is responsible for ensuring that appropriate consent has been obtained and that no data subjects have opted out of receiving communications.

26. Data Security — IT Security

26.1 Passwords must be changed regularly and must include a combination of uppercase letters, lowercase letters, numbers and symbols.

26.2 Passwords must not be written down or shared with any other person.

26.3 All software on ERFA devices must be kept up to date. Directors are responsible for ensuring security updates are installed promptly.

26.4 No software may be installed on ERFA devices without prior approval from Kingsley Ayalogu (Director).

27. Organisational Measures

ERFA ensures the following organisational measures are in place:

1. All staff are made fully aware of their responsibilities under UK GDPR and this Policy;
2. Access to personal data is restricted to those who require it to perform their duties;
3. All staff who handle personal data are appropriately trained;
4. All staff who handle personal data are appropriately supervised;
5. The methods used to collect, hold and process personal data are regularly evaluated and reviewed;
6. The performance of staff handling personal data is regularly evaluated and reviewed;
7. All staff are contractually bound to comply with UK GDPR and this Policy;
8. Agents and contractors must ensure that their employees are held to the same conditions as ERFA's own staff; and
9. Any agent or contractor who fails to meet their obligations under this Policy shall indemnify and hold harmless ERFA against any loss, damage, cost or expense arising from that failure.

28. Transferring Personal Data Outside the EEA

ERFA does not transfer personal data outside the European Economic Area (EEA) unless one of the following conditions is met:

1. The transfer is made with the informed consent of the data subject;
2. The transfer is necessary for the performance of a contract between ERFA and the data subject;
3. The transfer is necessary for important reasons of public interest;
4. The transfer is necessary for the establishment, exercise or defence of legal claims;
5. The transfer is necessary to protect the vital interests of the data subject, where the data subject is physically or legally incapable of giving consent; or
6. The transfer is made from a register which, under applicable law, is intended to provide information to the public.

29. Data Breach Notification

29.1 All personal data breaches must be reported immediately to the DPO, Kingsley Ayalogu.

29.2 Where a breach is likely to result in a risk to the rights and freedoms of data subjects, the ICO must be informed within 72 hours of ERFA becoming aware of the breach.

29.3 Where a breach is likely to result in a high risk to the rights and freedoms of data subjects, all affected data subjects must be informed directly and without undue delay.

29.4 All breach notifications must include:

1. The categories and approximate number of data subjects affected;
2. The categories and approximate number of personal data records affected;
3. The name and contact details of the DPO;
4. The likely consequences of the breach; and
5. The measures taken or proposed to address the breach and to mitigate its effects.

30. Third Party Links

This website may contain links to third-party websites. ERFA does not control those websites and accepts no responsibility or liability for their privacy policies or practices. We recommend that you read the privacy notice of every website you visit.

31. Cookies

Your browser can be set to refuse some or all cookies. Please note that if cookies are disabled, some parts of this website may be inaccessible or may not function as intended. For more information about managing cookies, please refer to our Cookie Policy.

32. Implementation of This Policy

This Policy is effective as of 1st April 2026 and has no retroactive effect.

Approved and authorised by:

• Name: K. C. Ayalogu
• Position: Director
• Date: 1st April 2026
• Next Review Date: 1st April 2027