Last updated: January 2024
Our Commitment
cragcliff is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise that protecting personal data is fundamental to maintaining trust with our clients and website visitors.
Data Protection Principles
We adhere to the core principles of data protection:
- Lawfulness, Fairness and Transparency: We process data lawfully, fairly, and in a transparent manner
- Purpose Limitation: We collect data only for specified, explicit, and legitimate purposes
- Data Minimisation: We limit data collection to what is necessary for our stated purposes
- Accuracy: We take reasonable steps to ensure personal data is accurate and up to date
- Storage Limitation: We retain data only for as long as necessary
- Integrity and Confidentiality: We implement appropriate security measures to protect data
- Accountability: We demonstrate compliance with these principles
Your Rights Under UK GDPR
As a data subject, you have the following rights:
Right to Be Informed
You have the right to receive clear information about how we use your personal data. Our Privacy Policy provides this information.
Right of Access
You can request a copy of the personal data we hold about you. We will respond to such requests within one month.
Right to Rectification
If your personal data is inaccurate or incomplete, you have the right to have it corrected.
Right to Erasure
In certain circumstances, you can request that we delete your personal data. This applies when the data is no longer necessary for its original purpose, you withdraw consent, or there is no legitimate reason for continued processing.
Right to Restrict Processing
You can request that we limit how we use your data while concerns about accuracy or processing are resolved.
Right to Data Portability
Where technically feasible, you can request your data in a structured, commonly used format to transfer to another organisation.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision Making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.
Exercising Your Rights
To exercise any of these rights, contact us at:
Email: [email protected]
Address: Wellington House, 38 Park Row, Leeds, LS1 5JL
We will respond to all legitimate requests within one month. If your request is complex or numerous, we may extend this period by two months, but we will inform you of any extension and the reasons for it.
Identity Verification
To protect your data, we may request verification of your identity before processing requests related to your personal data.
Data Protection Contact
For any questions regarding data protection or to raise concerns about how we handle your data, contact us at [email protected]
Supervisory Authority
If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Data Processing Records
We maintain records of our processing activities as required by Article 30 of the UK GDPR. These records document the categories of data processed, purposes, recipients, retention periods, and security measures.
Data Protection Impact Assessments
Where processing is likely to result in high risk to individuals' rights and freedoms, we conduct data protection impact assessments to identify and mitigate risks.
Data Breach Procedures
We have procedures in place to detect, investigate, and report personal data breaches. Where a breach is likely to result in high risk to individuals, we will notify affected persons without undue delay.
Third-Party Processing
When we engage third parties to process personal data on our behalf, we ensure appropriate contractual safeguards are in place. Processors are required to implement adequate security measures and process data only according to our instructions.