GDPR Information
Last updated: October 2024
This page provides information about how we comply with the UK General Data Protection Regulation (UK GDPR) and your rights as a data subject. This should be read alongside our Privacy Policy which provides comprehensive details about our data processing practices.
1. Data Controller
Cosmicmeadow is the data controller responsible for your personal data collected through this website and our consulting services. Our contact details are:
Cosmicmeadow
47 Greenway Business Centre
Pemberton Road
Bristol BS8 3HQ
United Kingdom
Email: [email protected]
2. Data Protection Principles
We adhere to the data protection principles set out in the UK GDPR. Personal data must be:
- Processed lawfully, fairly, and transparently
- Collected for specified, explicit, and legitimate purposes
- Adequate, relevant, and limited to what is necessary
- Accurate and kept up to date
- Kept for no longer than necessary
- Processed securely with appropriate protection against unauthorised processing, loss, destruction, or damage
3. Lawful Bases for Processing
We only process personal data when we have a lawful basis to do so. The lawful bases we rely on include:
Contract
Processing necessary for the performance of a contract with you or to take steps at your request before entering into a contract. This applies when you engage our consulting services.
Legitimate Interests
Processing necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include responding to enquiries, improving our services, and maintaining business records.
Consent
Where you have given clear consent for us to process your personal data for a specific purpose. You may withdraw consent at any time.
Legal Obligation
Processing necessary to comply with our legal obligations, such as financial record-keeping requirements.
4. Your Rights Under GDPR
The UK GDPR provides you with specific rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you. We will respond to valid requests within one month.
Right to Rectification
You have the right to request correction of inaccurate personal data or completion of incomplete data.
Right to Erasure
You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected.
Right to Restrict Processing
You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data.
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision Making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making.
5. Exercising Your Rights
To exercise any of your data protection rights, please contact us using the details above. We may need to verify your identity before processing your request. We will respond to valid requests within one month, though this may be extended by two months for complex requests, in which case we will inform you.
There is no fee for exercising your rights in most circumstances. However, we may charge a reasonable fee if requests are manifestly unfounded or excessive.
6. Data Security
We implement appropriate technical and organisational security measures to protect personal data, including:
- Encryption of data in transit and at rest where appropriate
- Access controls limiting data access to authorised personnel
- Regular security assessments and updates
- Staff training on data protection responsibilities
7. Data Breach Procedures
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
8. International Data Transfers
If we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the Information Commissioner, or adequacy decisions recognising the receiving country's data protection standards.
9. Complaints
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
10. Updates
We may update this GDPR information periodically. Significant changes will be communicated through our website.