← Back to Trust Centre

Breach Response

Last updated: 31 July 2026 · Draft — pending solicitor review before this is relied on commercially

What counts as a breach

Any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed through Halcyra.

What happens if one occurs

  1. The issue is contained and assessed as soon as it's identified.
  2. Affected customer firms are notified without undue delay, and in any case within 72 hours of Halcyra becoming aware, in line with UK GDPR processor obligations.
  3. The notification sets out what happened, what data's affected, and what's being done about it, so the customer firm (as controller) can meet its own notification obligations to the ICO and affected tenants if required.
  4. A summary of the cause and the fix is provided once the investigation is complete.

How to report a suspected issue

Email hello@halcyra.co.uk with "Security issue" in the subject line. This inbox is checked regularly; for anything urgent, say so in the subject line as well.