GDPR Compliance Statement

Last Updated: September 30, 2026

Our Commitment to Data Protection

shallowbreeze is committed to protecting your personal data and respecting your privacy rights in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document outlines how we fulfill our obligations as a data controller.

Data Controller Information

Data Controller: shallowbreeze
Address: 142 Colmore Row, Birmingham, B3 3AG, United Kingdom
Contact: [email protected]

Principles of Data Processing

We process personal data in accordance with the following GDPR principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes
• Data Minimization: We collect only data that is adequate, relevant, and necessary
• Accuracy: We take reasonable steps to ensure personal data is accurate and up-to-date
• Storage Limitation: We retain data only as long as necessary for the purposes collected
• Integrity and Confidentiality: We implement appropriate security measures to protect data
• Accountability: We can demonstrate compliance with all these principles

Legal Basis for Processing

We process your personal data under one or more of the following legal bases:

• Consent: You have given explicit consent for processing your data for specific purposes
• Contract: Processing is necessary for performing a contract with you or taking pre-contractual steps
• Legal Obligation: Processing is necessary to comply with legal requirements
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights

Your Rights Under GDPR

As a data subject, you have the following rights:

1. Right to Be Informed

You have the right to clear, transparent information about how we use your personal data.

2. Right of Access

You can request access to your personal data and receive a copy of the information we hold about you.

3. Right to Rectification

You can request correction of inaccurate or incomplete personal data.

4. Right to Erasure

You can request deletion of your personal data in certain circumstances, including when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

5. Right to Restrict Processing

You can request limitation of how we process your data in certain situations.

6. Right to Data Portability

You can request transfer of your data to another organization or directly to you in a structured, commonly used format.

7. Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

8. Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that significantly affects you.

How to Exercise Your Rights

To exercise any of your rights, please contact us at [email protected] with:

• Your full name
• Your contact details
• A clear description of which right you wish to exercise
• Any relevant details or documentation

We will respond to your request within one month, though this may be extended by two additional months for complex requests. We will inform you of any extension within the first month.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Staff training on data protection obligations
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions recognizing equivalent data protection standards
• Standard contractual clauses approved by the ICO
• Binding corporate rules

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals' rights and freedoms.

Third Party Processing

When we engage third-party processors, we ensure:

• They provide sufficient guarantees of appropriate security measures
• A written contract governs the processing relationship
• They only process data according to our documented instructions
• They assist us in meeting our GDPR obligations

Record Keeping

We maintain records of our processing activities as required by Article 30 of the GDPR, including:

• Purposes of processing
• Categories of data subjects and personal data
• Categories of recipients
• Details of transfers to third countries
• Retention periods
• Security measures

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

Policy Updates

This GDPR compliance statement may be updated periodically to reflect changes in our data processing practices or regulatory requirements. We will notify you of any material changes through our website.

Contact for Data Protection Matters

For any questions or concerns regarding data protection, GDPR compliance, or exercising your rights:

Email: [email protected]
Address: 142 Colmore Row, Birmingham, B3 3AG, United Kingdom