GDPR Compliance

Last updated: January 2024

lucid-orchard is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines our commitment to data protection and explains your rights as a data subject.

Our Role as Data Controller

For the purposes of data protection legislation, lucid-orchard acts as the data controller for personal information collected through this website and our services. This means we determine the purposes and means of processing your personal data.

Data Protection Principles

We adhere to the following data protection principles as set out in the UK GDPR:

• Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes only
• Data minimisation: We limit data collection to what is necessary for stated purposes
• Accuracy: We take reasonable steps to ensure personal data is accurate and up to date
• Storage limitation: We retain data only for as long as necessary
• Integrity and confidentiality: We implement appropriate security measures to protect personal data
• Accountability: We can demonstrate compliance with these principles

Your Data Subject Rights

The UK GDPR provides you with specific rights regarding your personal data. We respect and uphold these rights.

Right to Be Informed

You have the right to be informed about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR statement.

Right of Access

You can request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.

Right to Rectification

You have the right to have inaccurate personal data corrected or incomplete data completed. Contact us if you believe any information we hold about you needs updating.

Right to Erasure

Also known as the "right to be forgotten", you can request deletion of your personal data in certain circumstances, including:

• When the data is no longer necessary for its original purpose
• When you withdraw consent (where consent was the legal basis)
• When you object to processing and there are no overriding legitimate grounds
• When the data was unlawfully processed

Right to Restrict Processing

You can request restriction of processing in certain circumstances, such as when you contest the accuracy of data or while we verify whether our legitimate grounds override yours.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision making.

Exercising Your Rights

To exercise any of your data subject rights, please contact us using the details below. When making a request, please provide:

• Your full name and contact details
• Specific details about your request
• Any information that helps us identify your records

We may request verification of your identity before processing certain requests to ensure data is only released to the rightful data subject.

Response Times

We aim to respond to all data subject requests within one month. In complex cases, we may extend this by up to two further months, but we will inform you of any extension within the initial one-month period.

Fees

Most requests will be handled free of charge. However, we may charge a reasonable fee for manifestly unfounded or excessive requests, or for additional copies of data.

Data Breach Notification

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach poses a high risk to affected individuals, we will also notify them directly.

Data Protection Officer

Given the nature and scale of our data processing activities, we have not appointed a formal Data Protection Officer. However, all data protection matters are handled by our senior management team, who can be contacted via the details below.

Contact for Data Protection Matters

lucid-orchard
Data Protection Enquiries
14 Whitmore Street
London, EC2A 4PQ
United Kingdom
Email: [email protected]

Complaints

If you are unsatisfied with our response to a data protection concern, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Updates to This Statement

We review our data protection practices regularly and may update this statement accordingly. Significant changes will be communicated through our website.