lush-prairie is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we ensure compliance and protect your personal data.
Data Controller
lush-prairie acts as the data controller for personal information collected through this website. We determine the purposes and means of processing personal data in accordance with applicable data protection laws.
Lawful Basis for Processing
We process personal data under the following lawful bases:
Consent
When you submit an enquiry form or contact us, you consent to the processing of your personal data for the purpose of responding to your request. You may withdraw consent at any time by contacting us.
Contractual Necessity
When we enter into a service agreement, processing your personal data becomes necessary for contract performance, including communication, invoicing, and service delivery.
Legitimate Interests
We may process data based on legitimate business interests, such as improving our services, website analytics, and maintaining security. We always balance these interests against your rights and freedoms.
Your Data Protection Rights
Right to Access
You have the right to request copies of your personal data. We will provide this information free of charge within one month of your request.
Right to Rectification
You have the right to request correction of personal data you believe is inaccurate or incomplete.
Right to Erasure
You have the right to request deletion of your personal data under certain circumstances, including when the data is no longer necessary for its original purpose.
Right to Restrict Processing
You have the right to request restriction of processing while we verify accuracy of data or assess a legitimate interest objection.
Right to Data Portability
You have the right to request transfer of your personal data to another organisation or directly to you in a structured, machine-readable format.
Right to Object
You have the right to object to processing based on legitimate interests. We will stop processing unless we demonstrate compelling legitimate grounds.
Data Protection Measures
We implement appropriate technical and organisational measures including:
- Encryption of data in transit using SSL/TLS protocols
- Secure storage with access controls
- Regular security assessments
- Staff training on data protection
- Data minimisation practices
- Regular review of data retention periods
Data Breach Procedures
In the event of a personal data breach, we have procedures in place to:
- Identify and contain the breach promptly
- Assess the risk to affected individuals
- Notify the Information Commissioner's Office within 72 hours where required
- Inform affected individuals where there is high risk to their rights
- Document the breach and response actions
International Data Transfers
We primarily store and process data within the United Kingdom. Any transfer to third countries will only occur with appropriate safeguards such as standard contractual clauses or adequacy decisions.
Exercising Your Rights
To exercise any of your data protection rights, please contact us:
Email: [email protected]
Address: Unit 14, Riverside Studios, Wharf Road, Manchester M15 4QT, United Kingdom
We will respond to your request within one month. If your request is complex or numerous, we may extend this period by two months, informing you accordingly.
Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
Last updated: January 2024