GDPR Compliance

This page outlines our compliance with the General Data Protection Regulation (GDPR), which governs the processing of personal data for individuals within the European Economic Area (EEA) and United Kingdom.

Our Commitment to Data Protection

We are committed to protecting your personal data and respecting your privacy rights under GDPR. This includes ensuring transparency about data collection, providing control over your information, and maintaining security of data we process.

Data Controller Information

For the purposes of GDPR, atoll-beaver acts as the data controller for personal information collected through this website and related services.

Contact Information:
Email: [email protected]
Address: 47 Clarence Gardens, Kensington, London SW7 4JB, United Kingdom

Lawful Basis for Processing

We process personal data only when we have a lawful basis under GDPR Article 6:

• Consent (Article 6(1)(a)): You have given clear consent for us to process your personal data for specific purposes
• Contract (Article 6(1)(b)): Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
• Legal Obligation (Article 6(1)(c)): Processing is necessary for compliance with legal obligations
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for legitimate interests pursued by us or a third party, except where such interests are overridden by your data protection rights

Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15)

You have the right to obtain confirmation as to whether your personal data is being processed, and if so, to access that data and receive information about the processing activities.

Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and to have incomplete data completed.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data in certain circumstances, including when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal or similarly significant effects.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. Please include:

• Your full name and contact information
• Specific right you wish to exercise
• Details of your request
• Proof of identity (to prevent unauthorized access)

We will respond to requests within one month of receipt. In complex cases, this period may be extended by two additional months, about which we will inform you.

Data Protection Principles

Our data processing adheres to GDPR principles outlined in Article 5:

• Lawfulness, Fairness, and Transparency: Processing is lawful, fair, and transparent to data subjects
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes
• Data Minimization: Processing is limited to what is necessary for stated purposes
• Accuracy: Personal data is accurate and kept up to date
• Storage Limitation: Data is kept only as long as necessary
• Integrity and Confidentiality: Appropriate security measures protect data
• Accountability: We demonstrate compliance with these principles

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Pseudonymization and encryption of personal data
• Ongoing confidentiality, integrity, availability, and resilience of processing systems
• Regular testing and evaluation of security effectiveness
• Processes for timely restoration of data availability in case of incidents

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also communicate the breach to affected individuals without undue delay.

International Data Transfers

When personal data is transferred outside the EEA or UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the European Commission
• Standard contractual clauses approved by the European Commission
• Binding corporate rules
• Other legally approved transfer mechanisms

Children's Data

Our services are not directed to children under 16 years of age. We do not knowingly process data of children without appropriate parental consent where required by law.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of an alleged infringement.

For individuals in the UK, the relevant authority is the Information Commissioner's Office (ICO):
Website: https://ico.org.uk

Updates to This Page

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Significant changes will be communicated through appropriate channels.