GDPR Compliance

Last updated: January 2024

Our Commitment to GDPR

glossy-owl is committed to protecting the privacy and security of your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

glossy-owl is the data controller for personal data processed through this website. This means we are responsible for deciding how and why your personal data is processed.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month.

Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you without undue delay.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data where we are relying on legitimate interests as our legal basis.

Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing that significantly affects you. We do not currently use automated decision-making.

Lawful Basis for Processing

We process personal data only where we have a lawful basis to do so. The lawful bases we rely on include:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose
• Contract: Where processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legitimate interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest where appropriate
• Regular testing and evaluation of the effectiveness of security measures
• Access controls to limit who can access personal data
• Training for staff who handle personal data

International Transfers

We do not routinely transfer personal data outside the United Kingdom. If we do need to transfer data internationally, we will ensure appropriate safeguards are in place.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. If the breach is likely to result in a high risk to you, we will also notify you directly.

Exercising Your Rights

To exercise any of your rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to your request within one month, though this may be extended by a further two months for complex requests.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Contact Us

If you have any questions about GDPR or how we handle your personal data, please contact us at [email protected] or write to us at 47 Commerce Street, Manchester, M2 4LW, United Kingdom.