1. Introduction

DataOps IT Ltd is committed to operating with integrity, transparency, and accountability in everything we do. As a UK-based managed database services and cloud technology provider, we handle sensitive client data, design critical infrastructure, and build systems that underpin business operations across multiple sectors — including financial services, healthcare, government, and retail.

This statement is aligned with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the ICO's guidance on data ethics and accountability, and the ONS Data Ethics Framework. It applies to all DataOps IT staff, contractors, and third parties acting on our behalf.

2. Our Core Ethical Principles

Our work is guided by six core principles. These are not aspirational — they are operational requirements embedded into our processes, contracts, and governance structures.

2.1 Transparency We are open about how we collect, store, process, and share data. Our clients, partners, and employees have the right to understand how their data is used. We do not engage in concealed processing, and we publish clear policies that explain our practices in plain language.

2.2 Accountability Every data processing activity within DataOps IT has a designated owner. Our senior leadership team is directly accountable for compliance with this statement and all applicable data protection law. We do not delegate accountability away from those in positions of authority.

2.3 Fairness & Non-Discrimination We design and operate our services — including any automated or AI-assisted processes — in a manner that is fair and equitable. We do not build, deploy, or support systems that discriminate unlawfully against individuals on the basis of protected characteristics as defined under the Equality Act 2010.

2.4 Privacy & Data Protection We treat privacy as a fundamental right. We embed data protection into the design of all systems and services from the outset (Privacy by Design and Default), in accordance with UK GDPR Article 25. We collect only the data we need, retain it only for as long as necessary, and protect it with proportionate technical and organisational safeguards.

2.5 Security & Robustness Our clients trust us with some of their most critical assets. We apply enterprise-grade security controls — including encryption at rest and in transit, role-based access management, 24/7 monitoring, and regular penetration testing — to protect that trust. Systems are designed to fail safely and recover quickly.

2.6 Societal & Environmental Responsibility We acknowledge the broader impact of technology on society and the environment. We are mindful of the carbon footprint of large-scale data processing and cloud infrastructure, and we work with our clients and suppliers to minimise unnecessary resource consumption. We will not knowingly support projects that cause harm to individuals, communities, or the natural environment.

3. Data Governance & Compliance

DataOps IT operates a formal data governance framework consistent with UK GDPR, the Data Protection Act 2018, and ICO guidance. The following standards apply across all client engagements and internal operations.

Lawful Basis for Processing All personal data processed by DataOps IT — whether on behalf of clients or for our own purposes — is underpinned by a documented lawful basis under UK GDPR Article 6. Where special category data is involved, a further condition under Article 9 is identified and recorded before processing commences.

Data Minimisation We collect and process only the data that is adequate, relevant, and strictly necessary for the stated purpose. Scope extensions require a fresh assessment and, where applicable, client authorisation.

Purpose Limitation Client data is used solely for the agreed purpose. We do not repurpose, sell, trade, or derive independent commercial value from data belonging to our clients or their end users under any circumstances.

Retention & Secure Deletion Retention schedules are defined for all data categories and enforced through technical controls. Upon conclusion of an engagement, client data is returned or securely destroyed in line with contractual terms and applicable law.

Data Subject Rights We maintain documented procedures to support the full range of data subject rights under UK GDPR, including the rights of access, rectification, erasure, restriction, and portability. All requests are managed by our designated Data Protection Officer and fulfilled within statutory timeframes.

International Data Transfers DataOps IT does not transfer personal data outside the UK without an appropriate legal mechanism in place — such as an adequacy regulation, Standard Contractual Clauses, or equivalent safeguard — supported by a documented Transfer Impact Assessment where required.

4. AI & Automation Ethics

DataOps IT designs and manages data pipelines, analytics platforms, and increasingly AI-assisted systems on behalf of clients. We apply the following standards to all such work.

Explainability Where automated systems inform or produce decisions that affect individuals or material business outcomes, we design for explainability. Outputs must be interpretable by those responsible for acting on them. We do not deploy black-box systems in high-stakes environments without appropriate human oversight.

Bias Mitigation All datasets used to train, validate, or operate automated decision-making systems are assessed for bias prior to deployment. Where model performance differs materially across demographic groups, this is documented and addressed before go-live. Post-deployment monitoring for emergent bias is maintained throughout the system lifecycle.

Human Oversight We do not operate fully automated decision-making systems that produce legal or similarly significant effects on individuals without the safeguards required under UK GDPR Article 22. A qualified human reviewer is always part of any high-stakes decision process.

Prohibited Conduct DataOps IT will not design, build, or operate systems intended to:

• Manipulate individual behaviour through exploitation of psychological vulnerabilities
• Circumvent applicable legal or regulatory requirements
• Enable surveillance activities that lack appropriate lawful authority
• Operate autonomously in safety-critical environments without a human override capability

5. Client & Stakeholder Responsibilities

Honesty & Accuracy We provide clients with honest, evidence-based assessments of technical capability, data quality, and system limitations. We do not overstate what our systems can deliver, and we communicate adverse findings without delay.

Conflicts of Interest We maintain a Conflicts of Interest Register. Where a potential conflict arises, it is disclosed to the relevant client. Where a conflict cannot be appropriately managed, the engagement is declined.

No Unauthorised Use of Client Data Client data is strictly ring-fenced to the scope of the relevant engagement. DataOps IT will not access, use, or retain client data beyond what is necessary and authorised. All data is handled in accordance with our Data Processing Agreement and applicable law.

Subprocessors & Supply Chain Where DataOps IT engages subprocessors, we conduct due diligence to verify that they meet equivalent ethical and data protection standards. All subprocessor arrangements are governed by written agreements that reflect the requirements of UK GDPR Article 28.

Reporting Concerns Any individual — employee, contractor, or client representative — who has reasonable grounds to believe DataOps IT is acting inconsistently with this statement is encouraged to raise a concern. Reports can be made confidentially to our designated Ethics & Compliance contact. All concerns are investigated independently and without risk of detriment to the person raising them.

6. Risk Management & Continuous Improvement

Ethics Risk Register DataOps IT maintains a Data Ethics Risk Register, reviewed quarterly. All new services, technologies, and client engagements are assessed for ethical risk at inception.

Data Protection Impact Assessments (DPIAs) DPIAs are conducted for all processing activities likely to result in high risk to individuals, in accordance with UK GDPR Article 35. DPIA outputs are documented, reviewed by our DPO, and acted upon before processing begins.

Incident Response Personal data breaches are managed in accordance with our Incident Response Policy. Reportable breaches are notified to the ICO within 72 hours of discovery. Affected individuals are informed without undue delay where required under UK GDPR Articles 33–34. Every incident undergoes a post-event review, with findings used to strengthen controls.

Audit & Independent Review Internal compliance audits are conducted annually. Independent third-party assessments are commissioned at least every two years, or following any material change in processing activities. Findings are reported to the Board and tracked to resolution.

Training All DataOps IT staff complete mandatory data protection and ethics training at induction and annually thereafter. Specialist training is provided to engineers, data architects, and client-facing advisors working on sensitive or high-risk projects.

Statement Review This Ethical Statement is reviewed annually, and following any material change in law, regulation, or our operating activities. Amendments are approved by the Board and communicated to all staff, clients, and relevant stakeholders.

7. Accountability & Contact

DataOps IT designates named individuals with direct accountability for the matters covered in this statement. The following contacts are available for enquiries, data subject rights requests, and regulatory correspondence.

Approval:

Name: Aru Kaya

Title: CEO & Director  

Company: DataOps IT Ltd  

Date of Approval: 31 March 2026