GDPR Compliance

Last updated: June 23, 2026

We are committed to protecting your personal data and respecting your privacy rights in accordance with the UK General Data Protection Regulation and Data Protection Act 2018.

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to know how we collect, use, and share your personal data. This information is provided in our Privacy Policy.

Right of Access

You have the right to request access to the personal data we hold about you. This is commonly known as a subject access request. We will provide you with a copy of your personal data within one month of your request.

Right to Rectification

If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. We will respond to your request within one month.

Right to Erasure

Also known as the right to be forgotten, you can request that we delete your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose we collected it
• You withdraw your consent and there is no other legal basis for processing
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.

Right to Object

You have the right to object to our processing of your personal data where we are relying on legitimate interests as our legal basis for processing. We will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently engage in automated decision making.

Data Processing Principles

We process personal data in accordance with the following principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes
• Data Minimization: We only collect data that is adequate, relevant, and limited to what is necessary
• Accuracy: We take reasonable steps to ensure personal data is accurate and up to date
• Storage Limitation: We retain data only for as long as necessary for the purposes collected
• Integrity and Confidentiality: We process data securely with appropriate technical and organizational measures
• Accountability: We are responsible for and can demonstrate compliance with these principles

Legal Bases for Processing

We process your personal data under the following legal bases:

• Consent: When you have given clear consent for us to process your data for a specific purpose
• Contract: When processing is necessary for a contract we have with you
• Legal Obligation: When we must process your data to comply with the law
• Legitimate Interests: When processing is necessary for our legitimate interests or those of a third party, provided your interests do not override those interests

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Staff training on data protection and security
• Incident response and breach notification procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

International Data Transfers

When we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the UK authorities
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules for transfers within corporate groups

Complaints

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Website: ico.org.uk

Contact Us

For any questions about our GDPR compliance or to exercise your data protection rights, please contact us at:

witty-river
42 Clerkenwell Road
London EC1M 5PS
United Kingdom
Email: [email protected]