Privacy Policy

GDPR Privacy Policy of Great and Small Limited
Last updated: March 2026

Definitions
The Company – Great and Small Limited t/s Station House Vets, Teal House, Welburn, York YO60 7EP

GDPR – General Data Protection Regulation Act

Data Controller – means the natural or legal person who (either alone or jointly or in common with other persons), in this case Great and Small Limited, determines the purposes for which and the manner in which any personal information are, or are to be, processed.

Data Processor – means any natural or legal person who processes the data on behalf of the Data Controller. This
could be a third party – for example external laboratory, external reminder services etc

Data Subject – is any living individual who is using our Service and is the subject of Personal Data.

1. Principles for processing personal data
The Data Controller’s principles for processing personal data are:
Fairness and lawfulness. When we process personal data, the individual rights of the Data Subjects must be
protected. All personal data must be collected and processed in a legal and fair manner.
Restricted to a specific purpose. The personal data of Data Subject must be processed only for specific purposes.
Transparency. The Data Subject must be informed of how his/her data is being collected, processed and used.

2. What personal data we collect and process
The Company collects several different types of personal data for various purposes. Personal Data may include,
but is not limited to the Data subject’s:
Email address
First name and last name
Phone numbers
Address, Postal code

3. How we use the personal data
The Company collects personal data for various purposes:
To provide you with services. This could include a third party – for example external laboratory, external reminder
Services, contacting you through our third party IT systems etc
To gather analysis or valuable information so that we can improve our services
To detect, prevent and address technical issues
To contact you with internal marketing campaigns

4. Legal basis for collecting and processing personal data
The Company need to form a contract with you and you have given us the permission to do so and processing your personal data is in our legitimate interests and we need to comply with the law

5. Retention of personal data
The Company will retain your personal information only for as long as is necessary, we consider this to be five years after your last contact with us.
The Company will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.

6. Data protection rights
If you are a resident of the European Economic Area (EEA), you have certain data protection rights. If you wish to be
informed what personal data we hold about you and if you want it to be removed from our systems, please contact us.
In certain circumstances, you have the following data protection rights:
The right to access, update or to delete the information we have on you
The right of rectification
The right to object
The right of restriction
The right to data portability
The right to withdraw consent