GDPR Compliance

Last updated: November 2024

Our Commitment to Data Protection

Flux-blossom is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we uphold data protection principles and respect your rights as a data subject.

Data Protection Principles

We adhere to the following core principles when processing personal data:

• Lawfulness, fairness, and transparency: We process data lawfully and are open about how we use it
• Purpose limitation: We collect data only for specified, explicit, and legitimate purposes
• Data minimisation: We limit data collection to what is necessary for our stated purposes
• Accuracy: We take reasonable steps to ensure personal data is accurate and up to date
• Storage limitation: We retain data only for as long as necessary
• Integrity and confidentiality: We implement appropriate security measures to protect personal data
• Accountability: We are responsible for demonstrating compliance with these principles

Your Data Subject Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access

You may request a copy of the personal data we hold about you. We will respond to valid requests within one month and provide the information free of charge in most cases.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction. We will address rectification requests promptly.

Right to Erasure

In certain circumstances, you may request deletion of your personal data. This right applies when the data is no longer necessary, you withdraw consent, or processing was unlawful.

Right to Restrict Processing

You may request that we limit how we use your data while we verify its accuracy or assess whether our legitimate interests override your rights.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, unless specific conditions apply.

How to Exercise Your Rights

To exercise any of these rights, please submit a request to:

Data Protection Officer
Flux-blossom
47 Commerce Street
Birmingham, B2 4DP
[email protected]

We may need to verify your identity before processing your request. We aim to respond within one month, though this may be extended by two months for complex requests.

Data Protection Officer

We have appointed a Data Protection Officer to oversee our compliance with data protection obligations. You may contact our DPO at [email protected] for any data protection matters.

Data Processing Records

We maintain records of our processing activities as required by Article 30 of UK GDPR. These records document the purposes of processing, categories of data subjects and personal data, recipients, transfers, retention periods, and security measures.

Data Protection Impact Assessments

For processing operations that are likely to result in high risk to individuals, we conduct Data Protection Impact Assessments (DPIAs) to identify and minimise privacy risks.

Third-Party Processors

When we engage third-party processors, we ensure they provide sufficient guarantees regarding their data protection practices. We enter into written contracts that meet the requirements of Article 28 of UK GDPR.

Data Breach Procedures

We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours and, where required, inform affected individuals without undue delay.

Supervisory Authority

The supervisory authority for data protection in the United Kingdom is the Information Commissioner's Office (ICO). If you believe your data protection rights have been infringed, you may lodge a complaint with the ICO.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
www.ico.org.uk