GDPR Compliance

Our commitment to data protection

General Data Protection Regulation

We are committed to complying with the General Data Protection Regulation (GDPR) and protecting the rights of individuals whose personal data we process. This page outlines how we fulfill our obligations under the GDPR.

Data Controller

For the purposes of GDPR, we are the data controller of the personal information you provide to us. Our contact details are:

thicket-ibex
45 Clerkenwell Road
London, EC1M 5RS
United Kingdom
Email: [email protected]

Your Rights Under GDPR

The GDPR grants you specific rights regarding your personal data. These include:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for additional copies beyond the first request.

Right to Rectification

You have the right to request correction of any information you believe is inaccurate or to complete information you believe is incomplete.

Right to Erasure

You have the right to request deletion of your personal data under certain conditions, such as when the data is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You have the right to request that we restrict processing of your personal data under specific circumstances, such as when you contest the accuracy of the data.

Right to Object

You have the right to object to our processing of your personal data under certain conditions, particularly where we rely on legitimate interests as our legal basis.

Right to Data Portability

You have the right to request transfer of the data we have collected to another organization, or directly to you, under certain conditions.

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The lawful bases we rely on include:

  • Consent: You have given clear consent for us to process your personal data for specific purposes
  • Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
  • Legal obligation: Processing is necessary for us to comply with the law
  • Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, whether we can achieve those purposes through other means, and applicable legal requirements.

Data Security

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of personal data where appropriate
  • Regular security assessments and updates
  • Access controls to ensure data is accessed only by authorized personnel
  • Regular backups and disaster recovery procedures
  • Staff training on data protection and security

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

International Data Transfers

We primarily process and store data within the United Kingdom. If we transfer personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Automated Decision Making

We do not use automated decision-making or profiling in ways that produce legal effects concerning you or similarly significantly affect you.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us using the details provided above. We will respond to your request within one month, though we may extend this period by two further months where necessary, taking into account the complexity and number of requests.

We will not charge a fee for processing your request unless it is clearly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

Complaints

If you believe we have not complied with your data protection rights, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. Please check this page regularly to stay informed about how we protect your data.