GDPR Compliance

Data Controller

crag-leopard acts as the data controller for personal information collected through this website and our services. We are responsible for deciding how personal data is processed and for what purposes.

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by UK GDPR:

• Contractual necessity: Processing required to perform our service agreements with you
• Legitimate interests: Processing necessary for our business operations, provided it does not override your fundamental rights
• Consent: Where you have provided explicit consent for specific processing activities
• Legal obligation: Processing required to comply with applicable laws and regulations

Your Data Subject Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You may request a copy of the personal data we hold about you. We will respond to valid requests within one month.

Right to Rectification

You may request correction of any inaccurate or incomplete personal data we hold.

Right to Erasure

You may request deletion of your personal data where there is no compelling reason for continued processing. This right does not apply where we are required to retain data for legal or contractual reasons.

Right to Restrict Processing

You may request that we limit how we use your data in certain circumstances.

Right to Data Portability

You may request your personal data in a structured, commonly used format for transfer to another service provider.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

Data Protection Measures

We implement appropriate technical and organisational measures to ensure security of personal data, including:

• Secure data storage with access controls
• Encryption of sensitive information
• Regular security assessments
• Staff training on data protection
• Data minimisation principles

International Transfers

We primarily process data within the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and affected individuals without undue delay.

Exercising Your Rights

To exercise any of your data protection rights, please contact us:

Email: [email protected]
Address: Unit 14, Riverside Industrial Estate, Chelmsford, Essex CM2 6TE

Complaints

If you are unsatisfied with our handling of your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).