GDPR Compliance

Our Commitment to GDPR

clever-osprey takes data protection seriously and is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet our obligations under these regulations.

Data Controller

clever-osprey acts as the data controller for personal information collected through our website and services. As the data controller, we determine the purposes and means of processing personal data and bear responsibility for ensuring compliance with data protection principles.

Contact address:
47 Kensington Gardens Square
London W2 4BQ
Email: [email protected]

Principles We Follow

We adhere to the core principles of the UK GDPR in all our data processing activities:

• Lawfulness, fairness and transparency: We process data lawfully, fairly, and in a transparent manner. You are informed about how we use your information.
• Purpose limitation: We collect data for specified, explicit purposes and do not process it in ways incompatible with those purposes.
• Data minimisation: We collect only the information necessary for the purposes we have identified.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
• Storage limitation: We retain data only as long as necessary for the purposes of processing.
• Integrity and confidentiality: We implement appropriate security measures to protect personal data.
• Accountability: We maintain records and evidence of our compliance efforts.

Lawful Bases for Processing

Before processing personal data, we identify and document an appropriate lawful basis. The bases we rely upon include:

• Consent: You have given clear consent for us to process your personal data for a specific purpose, particularly when handling health-related information.
• Contract: Processing is necessary to fulfil a contract with you or to take steps at your request before entering into a contract.
• Legal obligation: Processing is necessary to comply with the law.
• Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, provided these do not override your rights.

Your Rights Under GDPR

The UK GDPR provides you with specific rights regarding your personal data:

Right to Be Informed

You have the right to receive clear and transparent information about how we process your data. This information is provided through our Privacy Policy and this GDPR page.

Right of Access

You can request a copy of the personal data we hold about you. We will respond to such requests within one month. There is no charge for the first copy, though we may charge a reasonable fee for additional copies or manifestly unfounded requests.

Right to Rectification

If you believe the information we hold about you is inaccurate or incomplete, you can request that we correct or complete it. We will respond within one month.

Right to Erasure

In certain circumstances, you can request that we delete your personal data. This right applies when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restrict Processing

You can request that we limit how we use your data in certain situations, such as while we verify accuracy or consider your objection to processing.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can request your data in a structured, commonly used, machine-readable format.

Right to Object

You can object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

Special Category Data

Our services may involve collecting health or mobility information, which is considered special category data under GDPR. We only process such data with your explicit consent, and you can withdraw this consent at any time.

Data Breaches

We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

International Transfers

Your data is primarily processed within the United Kingdom. If any transfer to countries outside the UK is necessary, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]
Address: 47 Kensington Gardens Square, London W2 4BQ

We aim to respond to all requests within one month. In complex cases, we may extend this by two additional months, but we will inform you if this is necessary.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.