GDPR Compliance

Our commitment

marsh-marmot is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws. This page explains how we fulfill our obligations under these regulations.

Legal basis for processing

We process your personal data under the following legal bases:

• Contract performance: Processing necessary to fulfill orders and provide services you've requested
• Legal obligation: Maintaining records required by UK tax and business laws
• Legitimate interests: Improving our services and responding to inquiries, balanced against your rights
• Consent: Only for optional communications, which you may withdraw at any time

Your rights under GDPR

You have the following rights regarding your personal data:

Right to access

You may request a copy of all personal data we hold about you. We will provide this within one month of your request.

Right to rectification

If any information we hold is incorrect or incomplete, you may request correction.

Right to erasure

You may request deletion of your personal data when it is no longer necessary for the purposes collected, or if you withdraw consent. Note that we may need to retain certain information to comply with legal obligations.

Right to restrict processing

You may request we limit how we use your data while we investigate a dispute about its accuracy or our right to use it.

Right to data portability

You may request your data in a structured, commonly used format to transfer to another service provider.

Right to object

You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights related to automated decision-making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts.

Exercising your rights

To exercise any of these rights, contact us at [email protected] with your request. We will respond within one month. If your request is complex or we receive multiple requests, we may extend this by two additional months and will inform you of the extension.

We may request specific information to confirm your identity before fulfilling your request.

Data security measures

We implement appropriate technical and organizational measures including:

• Encrypted transmission of sensitive data
• Regular security assessments
• Limited access to personal data on a need-to-know basis
• Secure storage with access controls
• Regular staff training on data protection obligations

International transfers

We do not transfer personal data outside the UK or European Economic Area. All data is stored and processed within the United Kingdom.

Data breach notification

In the event of a data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay and within 72 hours of becoming aware of the breach, as required by GDPR.

Children's privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from individuals under this age. If we become aware of such collection, we will delete the information promptly.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Contact our data protection officer

For questions about how we handle your personal data or to exercise your rights:
Email: [email protected]
Address: 47 Cartwright Lane, Bristol BS1 4DN, United Kingdom