Data protection policy
Last updated: 9 October 2026
Responsibility and purpose
Ekinadose Ewean Gabriel, operating Zedo World in England, United Kingdom, is responsible for authorising access, reviewing suppliers and retention, and responding to privacy requests. Staff and contractors must use personal information only for an authorised task, collect the minimum needed, keep it accurate, and follow the privacy policy. Questions and suspected incidents should be reported promptly to hellozedo@gmail.com.
Access and account security
- Use individual accounts, strong unique passwords and two-factor authentication for administration. Do not share passwords or recovery codes.
- Give access only to people who need it. Review administrator and supplier access regularly and remove it when a role ends.
- Store credentials in the deployment’s secret settings, not source code, chat messages or customer records. Rotate exposed credentials promptly.
- Lock devices, keep their software updated, and protect devices and any local copies of customer media with encryption and restricted access.
Children, uploads and production
Take extra care with children’s names, images and learning records. Confirm that the person submitting them has appropriate authority. Avoid collecting sensitive details that are unnecessary for the service.
Customer uploads must remain private. Do not change private Cloudinary assets to public delivery, post customer media to social channels, or upload it to personal AI accounts without a separately documented, appropriate authorisation. Do not use customer media for unrelated model training.
Before using a creative or AI supplier, review what it receives, its retention and training settings, access controls, processing terms and international-transfer arrangements. Give the customer the relevant information before sharing identifiable media. Assess risks involving children or AI likenesses and complete a data-protection impact assessment where required. This policy does not certify or approve an unspecified AI provider.
Storage, retention and deletion
Use approved storage and temporary private download links. Keep downloaded working copies only where necessary for production, with the same access restrictions as the original. Do not email media attachments unless the delivery arrangement and recipient have been checked.
Review records when an order, revision period, account or notification purpose ends. Delete or anonymise information that is no longer needed, including working copies and provider-hosted uploads. Preserve only records needed for a specific legal, accounting or dispute purpose and document that reason. Account for backup retention when answering deletion requests; do not promise that an active-system deletion instantly removes every backup.
Requests and consent
Record privacy requests, verify identity proportionately, identify affected systems and respond within the applicable deadline. Do not disclose one customer’s information to another person. Record notification withdrawals and stop the affected future messages. Check parental or guardian authority when a request concerns a child.
Incidents and recovery
Report suspected unauthorised access, lost devices, mistaken disclosures or exposed credentials immediately. Contain the incident, preserve necessary evidence, assess affected information and risks, and record decisions and remedial actions. Where UK GDPR applies, assess whether notification to the ICO is required within 72 hours of becoming aware; notify affected people without undue delay where the law requires it. Do not wait for a complete investigation before assessing notification duties.
Maintain protected backups and test restoration. Keep dependencies updated, review security alerts, and test sensitive access and payment flows after changes. Restrict incident records because they may themselves contain personal information.
Review
Review these rules when suppliers, services or data uses change, and periodically thereafter. Staff training, supplier contracts, backup testing and regulatory assessments are ongoing operational responsibilities; technical controls alone do not establish legal compliance.
Reference: ICO personal-data breach guidance.