GDPR Compliance

Our Commitment to GDPR

We are committed to complying with the General Data Protection Regulation (GDPR) and protecting the rights of individuals within the European Economic Area and the United Kingdom.

This page outlines how we fulfill our obligations under GDPR and how you can exercise your data protection rights.

Data Controller Information

For the purposes of GDPR, the data controller is:

domain
47 Whitfield Street
Fitzrovia
London W1T 4HB
United Kingdom

Contact email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

Consent (Article 6(1)(a))

We process data based on your explicit consent for:

• Marketing communications
• Non-essential cookies
• Optional data collection for service improvement

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Contract Performance (Article 6(1)(b))

We process data necessary to:

• Fulfill service contracts
• Deliver purchased services
• Process payments

Legal Obligation (Article 6(1)(c))

We process data to comply with legal requirements including:

• Tax and accounting obligations
• Regulatory reporting
• Responses to lawful requests from authorities

Legitimate Interests (Article 6(1)(f))

We process data for legitimate business interests:

• Website analytics and improvement
• Fraud prevention and security
• Business development and research

We balance these interests against your rights and will not process data in ways that override your fundamental rights and freedoms.

Your Data Protection Rights

Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, access to that data and information about how it is processed.

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data was unlawfully processed
• Legal obligations require erasure

Right to Restriction of Processing (Article 18)

You have the right to restrict processing when:

• You contest the accuracy of personal data
• Processing is unlawful but you oppose erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller when processing is based on consent or contract and carried out by automated means.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produces legal effects or similarly significant effects. We do not engage in such automated decision-making.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected] with:

• Your full name and contact information
• Description of your request
• Proof of identity (to prevent unauthorized access)

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

We do not charge a fee for processing rights requests unless the request is manifestly unfounded or excessive.

Data Protection Measures

We implement appropriate technical and organizational measures including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and audits
• Staff training on data protection
• Incident response procedures
• Secure data disposal processes

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay and within 72 hours of becoming aware of the breach, in accordance with Article 33 and 34 of GDPR.

Third-Party Processing

When we engage third-party processors, we:

• Enter into data processing agreements compliant with Article 28
• Ensure processors provide sufficient guarantees of data protection
• Monitor processor compliance with our instructions
• Maintain records of processing activities

International Data Transfers

When transferring data outside the EEA or UK, we ensure appropriate safeguards through:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions under Article 45
• Other lawful transfer mechanisms under Chapter V of GDPR

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account:

• Legal retention requirements
• Limitation periods for legal claims
• Operational necessity
• Your preferences regarding retention

See our Privacy Policy for specific retention periods by data category.

Children's Data

We do not knowingly process personal data of children under the age of sixteen without parental consent, in compliance with Article 8 of GDPR.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been infringed.

For the United Kingdom, the supervisory authority is:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website or directly to affected individuals.

Contact for Data Protection Matters

For questions about our GDPR compliance or to exercise your data protection rights:

Email: [email protected]