Consent should be clear,
recorded and reversible.
This policy sets out how Pintop Technologies Limited obtains, records, reviews and responds to the withdrawal of consent where consent is used as the lawful basis for processing personal data.
When this policy applies.
This policy applies where Pintop relies on an individual’s consent to process personal data. It describes the minimum requirements for obtaining valid consent, maintaining evidence, reviewing whether the consent remains appropriate and enabling withdrawal.
Consent is not automatically required for every processing activity. Where processing is necessary for a contract, required by law, based on legitimate interests or supported by another lawful basis, that processing is managed under the applicable basis.
The consent
lifecycle.
Consent is treated as an ongoing record and relationship, not a one-time checkbox.
Define the purpose
Identify the specific processing activity, the information involved and why consent is the appropriate lawful basis.
Inform the individual
Explain who Pintop is, what will happen, what data is involved and how consent may be withdrawn.
Capture a clear choice
Obtain an affirmative and unambiguous action without pre-selected choices or unnecessary pressure.
Record the evidence
Preserve who consented, when, how, for which purpose and which privacy information was presented.
Review or withdraw
Keep consent current, respond to material changes and stop consent-based processing when consent is withdrawn.
Standards for
valid consent.
Every consent mechanism must provide a meaningful and understandable choice.
Freely given
The individual must have a genuine choice and must be able to decline or withdraw without unfair detriment. Consent should not be tied to a service where the processing is unnecessary for that service.
Separate optional marketing consent from account or service registration.
Specific
Consent must relate to a defined purpose. Where activities have genuinely different purposes, individuals should be able to make separate choices.
Marketing email, testimonial publication and analytics should not be combined into one blanket consent.
Informed
Before making a choice, the individual should understand Pintop’s identity, the purpose, the relevant data, any material consequences and how to withdraw.
Unambiguous
Consent requires a clear affirmative action. Silence, inactivity, pre-selected boxes and general acceptance of unrelated terms are not treated as consent.
Separate and understandable
A consent request should be distinguishable from contracts, terms of service and other matters. The wording should be concise, accessible and appropriate for the intended audience.
What the Consent Register records.
Pintop maintains enough information to demonstrate the consent obtained and determine whether it remains active, has expired or has been withdrawn.
Consent records are retained while the consent remains active and for two years after withdrawal or expiry, under Pintop’s stated operational retention rule.
Identity
The individual or account associated with the recorded consent.
Date and time
When the affirmative choice was captured.
Purpose
The specific activity and processing purpose covered by the choice.
Collection method
Whether consent was obtained through a form, email, written document or documented oral statement.
Information presented
The relevant privacy notice, wording or version shown when consent was obtained.
Current status
Whether consent is active, withdrawn, expired or replaced by a subsequent record.
Leaving should be
as clear as joining.
An individual may withdraw consent at any time. Withdrawal does not invalidate processing that occurred lawfully before it was received.
Email marketing
Use the unsubscribe link contained in the message or contact Pintop directly.
Cookie preferences
Use the website’s Cookie Settings control to change non-essential cookie choices.
General withdrawal
Contact hi@pintoptechnologies.com and identify the activity for which consent is being withdrawn.
How Pintop handles a withdrawal
Record the request
The withdrawal is logged against the relevant consent record.
Identify affected processing
Pintop determines which activity relies solely on the withdrawn consent.
Stop consent-based activity
Relevant processing is discontinued under the applicable workflow, targeted within 30 calendar days under this policy.
Confirm the outcome
The individual is informed when the request has been processed or if another lawful basis remains applicable.
Keeping consent
current.
Consent is reviewed when time, inactivity or a material change creates doubt about whether the original choice remains appropriate.
Periodic review
Pintop’s policy is to review marketing and CRM consent on a 24-month cycle. Where there has been no relevant engagement, the record may be treated as stale and the individual removed from the activity unless fresh consent is obtained.
Material change
New consent is obtained where the original processing purpose, data use or expected impact changes in a way that falls outside the choice previously made. Administrative changes that do not alter the substance of the processing do not automatically require a new consent.
Children and individuals requiring additional protection
Pintop’s general website and enterprise services are not directed at children. Where a service is designed for, or reasonably likely to involve, children or persons without full legal capacity, additional age, authority and consent safeguards must be implemented before processing begins.
Review of earlier consents
Consent records obtained before this policy took effect should be assessed against the standards described here. Where the available record does not demonstrate an adequate choice, Pintop should obtain new consent, discontinue the processing or confirm that another lawful basis properly applies.
Clear internal
responsibilities.
Consent controls depend on the teams designing the experience, operating the systems and responding to individual requests.
Marketing and Communications Lead
Designs appropriate marketing choices, ensures unsubscribe mechanisms are available and maintains relevant campaign consent records.
Web Development Lead
Implements website consent controls, cookie preference functionality and the supporting technical records.
Data Protection Officer
Oversees the policy, reviews consent practices, supports the Consent Register and handles relevant enquiries, requests and complaints.
Product and Service Owners
Confirm whether consent is the appropriate basis, define the processing purpose and ensure product changes do not exceed the choice originally obtained.
All Staff
Ensure any consent they collect follows this policy and that the record is passed promptly to the responsible system or owner.
Related privacy and
governance documents.
These documents provide additional information about privacy notices, rights requests, cookies and retention.
Want to withdraw consent or question a consent record?
Identify the communication, website choice, account or processing activity involved so Pintop can locate and respond to the relevant record.