GDPR Compliance Statement

Our Commitment to Data Protection

spry-osprey is committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This statement outlines how we process personal data in accordance with these regulations.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

spry-osprey
47 Victoria Street
Bristol, BS1 6AD
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by GDPR:

Consent (Article 6(1)(a))

When you submit enquiry forms or subscribe to communications, you provide explicit consent for data processing. This consent can be withdrawn at any time.

Contract Performance (Article 6(1)(b))

Processing is necessary to enter into a contract with you or to perform contractual obligations related to renovation services.

Legitimate Interests (Article 6(1)(f))

We process data where necessary for legitimate business interests, including:

• Responding to service enquiries
• Maintaining business records
• Improving service quality
• Preventing fraud and ensuring security

Data Subject Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right of Access (Article 15)

You may request confirmation of whether we process your personal data and obtain a copy of that data. Requests will be fulfilled within one month.

Right to Rectification (Article 16)

You may request correction of inaccurate or incomplete personal data. We will make corrections within one month of receiving your request.

Right to Erasure (Article 17)

You may request deletion of your personal data under certain circumstances, including:

• Data is no longer necessary for the original purpose
• You withdraw consent and no other legal basis exists
• You object to processing and no overriding legitimate grounds exist
• Data has been unlawfully processed

Note that legal or contractual obligations may require us to retain certain data despite erasure requests.

Right to Restriction of Processing (Article 18)

You may request limitation of processing under specific conditions, such as when contesting data accuracy or while evaluating objections to processing.

Right to Data Portability (Article 20)

You may request your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless compelling legitimate grounds override your interests.

Data Protection Principles

We adhere to the following GDPR principles when processing personal data:

Lawfulness, Fairness, and Transparency

Data is processed lawfully, fairly, and in a transparent manner. We clearly communicate how data is used.

Purpose Limitation

Data is collected for specified, explicit, legitimate purposes and not processed in ways incompatible with those purposes.

Data Minimisation

We collect only data that is adequate, relevant, and limited to what is necessary for the stated purposes.

Accuracy

We take reasonable steps to ensure personal data is accurate and kept up to date. Inaccurate data is corrected or deleted without delay.

Storage Limitation

Personal data is retained only as long as necessary for the purposes for which it was collected or as required by law.

Integrity and Confidentiality

Data is processed securely using appropriate technical and organisational measures to protect against unauthorised access, loss, or damage.

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom or European Economic Area. Should such transfers become necessary, we will ensure appropriate safeguards are in place as required by GDPR Chapter V.

Data Breach Notification

In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay as required by Article 34 GDPR. We will also notify the relevant supervisory authority within 72 hours where feasible.

Automated Decision-Making

We do not engage in automated decision-making or profiling as defined by Article 22 GDPR.

Children's Data

Our services are directed at business clients. We do not knowingly collect personal data from individuals under 16 years of age.

Exercising Your Rights

To exercise any of your data protection rights, please contact us at:

Email: [email protected]
Address: 47 Victoria Street, Bristol, BS1 6AD, United Kingdom

We will respond to requests within one month. This period may be extended by two months for complex requests, with notification provided.

Complaints

If you believe we have not complied with data protection regulations, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: ico.org.uk

Updates to This Statement

This GDPR compliance statement may be updated to reflect changes in our data processing practices or legal requirements. Material changes will be communicated through prominent notice on our website.