GDPR Compliance

Last updated: January 2024

hazy-marsh is committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

Data Controller

hazy-marsh is the data controller responsible for your personal data. Our contact details are:

Email: [email protected]
Address: 42 Kensington Road, London, W8 4PL, United Kingdom

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes.
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided your rights do not override those interests.
• Legal obligation: Where processing is necessary to comply with our legal obligations.

Your Rights Under GDPR

Under the GDPR, you have the following rights:

Right to Access

You have the right to request copies of your personal data. We may charge a small fee for this service if requests are excessive or unfounded.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or incomplete.

Right to Erasure

You have the right to request that we erase your personal data under certain conditions, such as when the data is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data under certain conditions.

Right to Object

You have the right to object to our processing of your personal data under certain conditions, including processing for direct marketing purposes.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In some cases, we may extend this period by two months where requests are complex or numerous, but we will inform you of any such extension.

Data Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular assessment of security measures
• Staff training on data protection
• Access controls to personal data

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

International Transfers

We do not routinely transfer personal data outside the United Kingdom. Where any such transfer is necessary, we will ensure appropriate safeguards are in place as required by data protection law.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Changes to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.