GDPR Compliance

Our Commitment to Data Protection

Shade-brook is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognize the importance of protecting your personal information and respecting your privacy rights.

Data Controller Information

Shade-brook acts as the data controller for personal information collected through this website and in connection with our consultancy services.

Contact Details:
Shade-brook
42 Kensington Gardens
Manchester M14 5NB
United Kingdom
Email: [email protected]

Lawful Basis for Data Processing

We process personal data only when we have a lawful basis under UK GDPR. The specific basis depends on the context:

Consent

For marketing communications and certain website cookies, we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted before withdrawal.

Contract Performance

When you request our consultancy services, we process personal data necessary to fulfill our contractual obligations, including service delivery, communication, and billing.

Legitimate Interests

We process certain data based on legitimate business interests, such as:

• Operating and improving our website
• Preventing fraud and maintaining security
• Analyzing business performance
• Maintaining professional liability records

We conduct balancing assessments to ensure our interests do not override your fundamental rights and freedoms.

Legal Obligation

We process personal data when required by UK law, including tax regulations, health and safety legislation, and professional standards for consultancy services.

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will respond within one month of receiving a valid request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or completion.

Right to Erasure

In certain circumstances, you may request deletion of your personal data, including when:

• Data is no longer necessary for the original purpose
• You withdraw consent and no other legal basis exists
• You object to processing and no overriding legitimate grounds exist
• Data has been unlawfully processed

This right is not absolute. We may retain data when required for legal compliance or legitimate interests that override your request.

Right to Restriction of Processing

You may request that we limit how we use your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of our legitimate grounds

Right to Data Portability

For data processed based on consent or contract performance, you may request to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Exercising Your Rights

To exercise any of these rights, send a request to [email protected]. Please include:

• Your full name and contact information
• Description of the right you wish to exercise
• Any relevant details to help us locate your data

We will respond within one month, though complex requests may require up to three months. We will inform you if an extension is necessary.

We do not charge a fee for most requests. However, we may charge a reasonable administrative fee for manifestly unfounded, excessive, or repetitive requests.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security commensurate with the risks, including:

• Encryption of data in transit and at rest
• Access controls limiting data availability to authorized personnel
• Regular security assessments and updates
• Staff training on data protection responsibilities
• Incident response procedures for potential breaches

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also report breaches to the Information Commissioner's Office within 72 hours when required by law.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risks to individuals' rights and freedoms.

Third-Party Processors

When we engage third-party service providers to process personal data on our behalf, we:

• Select processors that provide sufficient guarantees of GDPR compliance
• Establish data processing agreements defining scope, duration, and obligations
• Ensure processors implement appropriate security measures
• Limit processing to documented instructions

International Data Transfers

Personal data is primarily processed within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the ICO
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules where applicable

Children's Data

Our services are not directed to individuals under 18. We do not knowingly collect or process personal data from children without appropriate parental consent.

Record Keeping

We maintain records of our processing activities as required by Article 30 of UK GDPR, including:

• Purposes of processing
• Categories of data subjects and personal data
• Recipients of personal data
• Retention periods
• Security measures

Updates to This Statement

We review and update this GDPR compliance statement periodically to reflect changes in our practices or legal requirements. The "Last Updated" date indicates when revisions were made.

Complaints and Concerns

If you have concerns about our data protection practices, please contact us at [email protected]. We will investigate and respond to your concerns.

You also have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk