GDPR Compliance

Last updated: January 2024

garnet-orchard is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we uphold data protection principles and respect your rights as a data subject.

Data Controller

garnet-orchard acts as the data controller for personal information collected through this website and in the course of providing environmental consulting services. We determine the purposes and means of processing personal data and are responsible for compliance with data protection legislation.

Data Protection Principles

We adhere to the following principles when processing personal data:

• Lawfulness, Fairness, and Transparency: We process data lawfully and openly, ensuring individuals understand how their information is used.
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.
• Data Minimisation: We only collect personal data that is adequate, relevant, and necessary for our stated purposes.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
• Storage Limitation: We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.
• Integrity and Confidentiality: We implement appropriate security measures to protect personal data against unauthorised or unlawful processing and accidental loss or damage.
• Accountability: We demonstrate compliance with data protection principles and maintain appropriate records of processing activities.

Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal information we hold about you. We will provide this information free of charge within one month of receiving a valid request.

Right to Rectification

If you believe any personal information we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to rectification requests within one month.

Right to Erasure

In certain circumstances, you have the right to request deletion of your personal data. This right applies when the data is no longer necessary for its original purpose, you withdraw consent, or the data has been unlawfully processed.

Right to Restrict Processing

You may request that we restrict the processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Upon objection, we will cease processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.

Exercising Your Rights

To exercise any of your data protection rights, please contact us using the details provided below. We may request verification of your identity before processing your request. We will respond to all valid requests within one month, though this period may be extended by a further two months for complex requests.

Data Protection Impact Assessments

Where processing is likely to result in a high risk to individuals' rights and freedoms, we conduct Data Protection Impact Assessments to evaluate and mitigate those risks before processing begins.

Data Breach Procedures

We maintain procedures for detecting, investigating, and reporting personal data breaches. Where a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. Where a breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

Supervisory Authority

If you are dissatisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Contact Information

For any questions regarding GDPR compliance or to exercise your data protection rights, please contact:

Email: [email protected]
Address: Unit 14, Fargo Village, Far Gosford Street, Coventry CV1 5ED, United Kingdom