GDPR Compliance

Last updated: September 2024

Our commitment to data protection

stone-osprey is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable UK data protection legislation.

Data controller

stone-osprey acts as the data controller for personal information collected through this website and in the course of providing our services.

Contact: [email protected]

Lawful basis for processing

We process personal data under the following lawful bases:

• Consent: When you submit forms or contact us voluntarily
• Legitimate interests: For operating our business, responding to enquiries, and improving services
• Contract: When necessary to deliver services you've requested
• Legal obligation: To comply with legal and regulatory requirements

Your GDPR rights

Under GDPR, you have the following rights regarding your personal data:

Right to access

You can request a copy of the personal data we hold about you.

Right to rectification

You can request correction of inaccurate or incomplete personal data.

Right to erasure

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purposes it was collected.

Right to restrict processing

You can request that we limit how we use your personal data in specific situations.

Right to data portability

You can request a copy of your personal data in a structured, commonly used format for transfer to another service.

Right to object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights related to automated decision making

We do not use automated decision making or profiling that produces legal effects concerning you.

Exercising your rights

To exercise any of these rights, contact us at [email protected]

We will respond to your request within one month. In complex cases, this may be extended by two additional months, and we will inform you of any extension.

Data security measures

We implement appropriate technical and organisational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection practices
• Incident response procedures

Data retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Enquiry data: 3 years from last contact
• Client project data: 7 years from project completion
• Marketing communications: Until consent is withdrawn

International data transfers

We primarily process data within the United Kingdom and European Economic Area. Any transfers outside these regions are conducted with appropriate safeguards in place, such as standard contractual clauses.

Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Children's data

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children.

Complaints

If you have concerns about how we handle your personal data, please contact us first at [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

Updates to this notice

We may update this GDPR compliance notice to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.