zephyrhollow

Our Commitment to Data Protection

We are committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (GDPR) and applicable UK data protection laws. This document outlines how we comply with GDPR requirements and respect data subject rights.

Legal Basis for Processing

We process personal data under the following legal bases:

Consent: When you submit consultation requests or provide information voluntarily through our website forms
Contract Performance: When processing is necessary to provide consulting services you have requested
Legitimate Interests: For business operations, website analytics, and service improvements where processing does not override your rights
Legal Obligations: When required to comply with legal or regulatory requirements

Data Subject Rights Under GDPR

As a data subject, you have the following rights regarding your personal information:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or completion of such data.

Right to Erasure

Under certain circumstances, you have the right to request deletion of your personal data. This right is subject to legal limitations, particularly where we must retain data to comply with legal obligations.

Right to Restriction of Processing

You may request restriction of processing in specific situations, such as when contesting data accuracy or objecting to processing.

Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, please submit a request to:

[email protected]

Or write to:
Data Protection Officer
47 Granby Street
Leicester, LE1 6FB
United Kingdom

We will respond to verified requests within one month of receipt. In complex cases, this period may be extended by an additional two months, in which case we will inform you of the extension and reasons for delay.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

Client consultation requests: Retained for two years or until engagement begins
Client project data: Retained for seven years following project completion for legal and business purposes
Website analytics data: Aggregated and anonymized after 26 months
Marketing communications consent: Retained until consent is withdrawn

After retention periods expire, personal data is securely deleted or anonymized.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security, including:

Encryption of data in transit and at rest
Access controls limiting data access to authorized personnel only
Regular security assessments and updates
Staff training on data protection obligations
Secure data backup and recovery procedures
Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and 34.

International Data Transfers

Our data processing operations are primarily conducted within the United Kingdom. When data transfers outside the UK are necessary, we ensure appropriate safeguards are in place, such as:

Standard contractual clauses approved by regulatory authorities
Adequacy decisions confirming recipient country data protection standards
Explicit consent for specific transfers where appropriate

Third-Party Data Processors

When we engage third-party service providers who process personal data on our behalf, we ensure they:

Provide sufficient guarantees of technical and organizational security measures
Process data only on our documented instructions
Maintain confidentiality obligations
Assist us in meeting GDPR compliance obligations

Data processing agreements are established with all processors in accordance with GDPR Article 28.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the relevant supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

Updates to This Policy

We review and update our GDPR compliance procedures regularly. Any material changes to how we process personal data will be communicated through updates to this page with notification of the revision date.

Contact Information

For questions regarding GDPR compliance or data protection practices: