GDPR Compliance

neo-birch is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we meet our obligations under data protection law.

Data Controller

neo-birch is the data controller responsible for your personal data. Our contact details are:

neo-birch
47 Whiteladies Road
Bristol, BS8 2LY
United Kingdom

Email: [email protected]

Principles We Follow

We adhere to the data protection principles set out in the UK GDPR:

• Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner.
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes only.
• Data minimisation: We ensure personal data is adequate, relevant, and limited to what is necessary.
• Accuracy: We keep personal data accurate and up to date.
• Storage limitation: We retain data only for as long as necessary.
• Integrity and confidentiality: We process data securely with appropriate technical and organisational measures.
• Accountability: We take responsibility for compliance and can demonstrate it.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Be Informed

You have the right to be informed about the collection and use of your personal data. Our Privacy Policy provides this information.

Right of Access

You can request a copy of the personal data we hold about you. We will respond to such requests within one month.

Right to Rectification

You can ask us to correct inaccurate personal data or complete incomplete data. We will make corrections within one month.

Right to Erasure

In certain circumstances, you can request that we delete your personal data. This right applies when the data is no longer necessary for its original purpose, you withdraw consent, or processing is unlawful.

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as when accuracy is contested or processing is unlawful but you do not want erasure.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, commonly used format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us using the details above. We will respond to your request within one month. If your request is complex, we may extend this period by up to two months, and we will inform you if this is the case.

We will not charge a fee for most requests. However, we may charge a reasonable fee if your request is manifestly unfounded or excessive, or we may refuse to comply with such requests.

Data Breaches

We have procedures in place to detect, investigate, and report personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours. Where there is a high risk to individuals, we will also notify those affected directly.

International Transfers

We do not routinely transfer personal data outside the United Kingdom. If this becomes necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Supervisory Authority

If you are not satisfied with how we handle your personal data or your data protection request, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk

Last updated: August 2024