GDPR Compliance

Last updated: January 2024

Our Commitment to GDPR

savanna-myth is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have implemented policies, procedures, and technologies to maintain the protection of data throughout our business.

Data Controller Information

For the purposes of applicable data protection legislation, the data controller is:

savanna-myth
47 Thornbury Road
Bradford, BD8 9PJ
West Yorkshire
United Kingdom

Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by Article 6 of the UK GDPR:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose, such as marketing communications.
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject.

Your Rights Under GDPR

Under the UK General Data Protection Regulation, you have several rights in relation to your personal information:

Right to Be Informed

You have the right to be informed about the collection and use of your personal data. This GDPR policy, along with our Privacy Policy, provides this information.

Right of Access

You have the right to access your personal data and supplementary information. This allows you to be aware of and verify the lawfulness of the processing.

Right to Rectification

You are entitled to have personal data corrected if it is inaccurate or incomplete.

Right to Erasure

You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

Right to Restrict Processing

You have the right to request the restriction or suppression of your personal data in certain circumstances.

Right to Data Portability

You have the right to obtain and reuse your personal data for your own purposes across different services.

Right to Object

You have the right to object to processing based on legitimate interests or the performance of a task in the public interest, direct marketing, and processing for purposes of scientific or historical research and statistics.

Rights Related to Automated Decision Making

You have rights in relation to automated decision making and profiling. We do not currently use automated decision-making processes.

Exercising Your Rights

To exercise any of your rights, please contact us using the details provided above. We will respond to your request within one month. In certain circumstances, we may extend this period by two further months where necessary, taking into account the complexity and number of requests.

There is no fee required to make a request. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Data Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of the effectiveness of security measures
• Access controls to ensure data is only accessible to authorised personnel
• Staff training on data protection and security

Data Breach Procedures

In the event of a personal data breach, we have procedures in place to:

• Investigate the breach and assess its severity
• Notify the Information Commissioner's Office (ICO) within 72 hours where required
• Notify affected individuals without undue delay where required
• Document the breach and our response

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom. Should this be necessary, we will ensure appropriate safeguards are in place in accordance with data protection legislation.

Complaints

If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details above.

You can also complain to the Information Commissioner's Office if you are unhappy with how we have used your data. Their contact details are:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: ico.org.uk

Changes to This Policy

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.