GDPR Compliance

Last updated: January 2024

Our Commitment to Data Protection

saffron-sprout is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet our obligations under these regulations.

Data Controller

saffron-sprout acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing your personal data in accordance with applicable law.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you voluntarily submit information through our contact forms or request our services
• Contract: When processing is necessary to fulfil our consultation services agreement with you
• Legal Obligation: When we must process data to comply with legal requirements
• Legitimate Interests: For business operations that do not override your fundamental rights

Your Data Protection Rights

Under UK GDPR, you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your data in certain circumstances
• Right to Restrict Processing: You can request that we limit how we use your data
• Right to Data Portability: You can request your data in a machine-readable format
• Right to Object: You can object to processing based on legitimate interests
• Rights Related to Automated Decision Making: You have rights concerning profiling and automated decisions

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by two months, but we will inform you if this is necessary.

Data Protection Measures

We implement appropriate security measures including:

• Encryption of personal data in transit and at rest
• Access controls limiting data access to authorised personnel
• Regular security assessments and updates
• Staff training on data protection principles
• Secure disposal procedures for data no longer required

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Contact Our Data Protection Team

For data protection enquiries, please contact us at [email protected] or write to: Data Protection, saffron-sprout, 47 Wellington Street, Leeds, LS1 4JN.