GDPR Compliance

Our Commitment to GDPR

spire-otter is committed to complying with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We take the privacy and security of personal data seriously and have implemented measures to ensure compliance with these regulations.

Data Controller

spire-otter acts as the data controller for personal information collected through this website and during service delivery. We determine the purposes and means of processing personal data and are responsible for ensuring that processing is lawful.

Lawful Basis for Processing

We process personal data only when we have a valid legal basis to do so. The primary grounds under which we process data include:

• Consent: Where you have given clear, affirmative consent for us to process your personal data for specific purposes
• Contractual necessity: Where processing is required to fulfil a contract with you or take steps at your request prior to entering a contract
• Legal obligation: Where processing is necessary to comply with UK law
• Legitimate interests: Where processing serves our legitimate business interests, provided these do not override your fundamental rights

Your Rights Under GDPR

The GDPR provides individuals with specific rights regarding their personal data:

• Right of access: You may request a copy of the personal data we hold about you
• Right to rectification: You may request correction of inaccurate or incomplete data
• Right to erasure: You may request deletion of your data in certain circumstances
• Right to restrict processing: You may request that we limit how we use your data
• Right to data portability: You may request your data in a structured, machine-readable format
• Right to object: You may object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: You have rights concerning decisions made without human involvement

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month of receiving it. In complex cases, this period may be extended by two months, and we will inform you of any such extension.

Data Protection Principles

We adhere to the core principles of data protection:

• Lawfulness, fairness, and transparency in processing
• Purpose limitation: collecting data for specified, explicit purposes
• Data minimisation: collecting only what is necessary
• Accuracy: keeping data up to date
• Storage limitation: retaining data only as long as needed
• Integrity and confidentiality: protecting data appropriately
• Accountability: demonstrating compliance with these principles

International Transfers

We do not routinely transfer personal data outside the United Kingdom. Where any such transfer is necessary, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Data Breaches

We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). We encourage you to contact us first so we can address your concerns directly.

Contact Information

For GDPR-related enquiries, please contact:

Email: [email protected]
Address: 47 Colmore Row, Birmingham, B3 2BS, United Kingdom