Last Updated: January 2024
Our Commitment to GDPR
Ravine-side is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise the importance of protecting personal data and have implemented comprehensive measures to safeguard the information you entrust to us.
Data Controller Information
For the purposes of UK GDPR, the data controller is:
Ravine-side
47 Wellington Street
London, EC2A 4PQ
United Kingdom
Email: [email protected]
Your Rights Under UK GDPR
Under UK GDPR, you have several rights concerning your personal data. We are committed to facilitating the exercise of these rights:
Right to Be Informed
You have the right to be informed about the collection and use of your personal data. Our Privacy Policy provides detailed information about how we collect, use, and process your data.
Right of Access
You have the right to access your personal data and supplementary information. This enables you to be aware of and verify that we are processing your data lawfully. To request access, please contact us using the details provided above.
Right to Rectification
You have the right to have inaccurate personal data corrected and incomplete data completed. If you believe any information we hold about you is incorrect, please notify us and we will promptly address the matter.
Right to Erasure
Also known as the "right to be forgotten", you may request the deletion of your personal data in certain circumstances, including:
- The data is no longer necessary for its original purpose
- You withdraw consent (where consent was the basis for processing)
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
Right to Restrict Processing
You have the right to request the restriction of processing of your personal data in certain circumstances. When processing is restricted, we may store the data but not further process it.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You also have the right to have this data transmitted to another controller where technically feasible.
Right to Object
You have the right to object to processing based on legitimate interests, direct marketing, and processing for research or statistical purposes.
Rights Related to Automated Decision Making
You have rights regarding automated decision-making, including profiling. We do not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.
How to Exercise Your Rights
To exercise any of your rights, please contact us at:
Email: [email protected]
We will respond to your request within one month. In certain circumstances, this may be extended by a further two months where requests are complex or numerous, and we will inform you if this is the case.
Data Processing Principles
We adhere to the following principles when processing personal data:
- Lawfulness, Fairness, and Transparency: Processing is conducted lawfully, fairly, and in a transparent manner
- Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes
- Data Minimisation: Data collected is adequate, relevant, and limited to what is necessary
- Accuracy: Personal data is accurate and kept up to date
- Storage Limitation: Data is kept only as long as necessary
- Integrity and Confidentiality: Data is processed securely with appropriate protection
- Accountability: We are responsible for and can demonstrate compliance
Lawful Basis for Processing
We only process personal data where we have a lawful basis to do so. The lawful bases we rely on include:
- Consent from the data subject
- Performance of a contract
- Compliance with legal obligations
- Legitimate interests (where these do not override individual rights)
Data Security Measures
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data
- Ability to ensure ongoing confidentiality, integrity, and availability of systems
- Ability to restore access to personal data in a timely manner following an incident
- Regular testing and evaluation of security measures
Data Breach Notification
In the event of a personal data breach, we have procedures in place to:
- Detect, investigate, and report breaches
- Notify the Information Commissioner's Office within 72 hours where required
- Notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms
Third-Party Processing
Where we engage third parties to process personal data on our behalf, we ensure that appropriate contracts and safeguards are in place to protect your data.
International Data Transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards are implemented in compliance with UK GDPR requirements.
Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Website: ico.org.uk
Contact Us
For any questions regarding our GDPR compliance or to exercise your data protection rights, please contact us at [email protected].