GDPR Compliance

Our Commitment

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the protection of personal data seriously and have implemented measures to ensure that we handle your information responsibly and in accordance with the law.

Data Controller

For the purposes of data protection legislation, we act as the data controller for personal information collected through this website. This means we determine the purposes and means of processing your personal data.

Lawful Basis for Processing

We only process personal data where we have a lawful basis to do so. The lawful bases we rely upon include:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose
• Contract: Where processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, unless there is a good reason to protect your personal data which overrides those interests
• Legal obligation: Where processing is necessary for us to comply with the law

Data Subject Rights

Under the UK GDPR, you have several rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you
• Right to rectification: You can ask us to correct inaccurate personal data
• Right to erasure: You can ask us to delete your personal data in certain circumstances
• Right to restrict processing: You can ask us to limit how we use your data
• Right to data portability: You can ask us to transfer your data to another organisation
• Right to object: You can object to certain types of processing, including direct marketing
• Rights regarding automated decision-making: You have rights in relation to automated decision-making and profiling

Exercising Your Rights

To exercise any of your rights, please contact us using the details on our contact page. We will respond to your request within one month. If your request is complex or you have made multiple requests, we may extend this period by a further two months, but we will inform you if this is the case.

We do not charge a fee for handling requests in most cases. However, we may charge a reasonable fee if your request is clearly unfounded or excessive, or we may refuse to comply with the request in such circumstances.

Data Protection Measures

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Secure storage of personal data
• Access controls to limit who can access personal data
• Regular review of our data processing activities
• Staff training on data protection
• Procedures for handling data breaches

International Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place to protect your information in accordance with data protection law.

Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where appropriate, we will also notify affected individuals.

Contact and Complaints

If you have any questions about our GDPR compliance or wish to make a complaint about how we have handled your personal data, please contact us via the details on our contact page.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data properly.