Your data protection rights under UK GDPR
onyx-branch is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations and explains your rights as a data subject.
We believe in transparency and accountability in how we handle your personal information. This commitment extends to every aspect of our data processing activities, from initial collection through storage, use, and eventual deletion.
For the purposes of data protection legislation, onyx-branch acts as the data controller for personal information collected through our website and services.
Contact details:
Email: [email protected]
Address: 42 Wellington Street, Leeds, LS1 4AB, United Kingdom
We process personal data only when we have a lawful basis to do so. Our processing activities rely on the following legal grounds:
When you voluntarily provide information through our consultation request forms or contact methods, you give us explicit consent to process that data for the stated purposes. You have the right to withdraw this consent at any time.
When you engage our consultation services, we process your information to fulfill our contractual obligations to you, including scheduling appointments, conducting consultations, and providing follow-up guidance.
We may process certain data based on our legitimate business interests, such as improving our services, maintaining website security, and analyzing usage patterns. We always balance these interests against your rights and freedoms.
In some cases, we process data to comply with legal obligations, such as record-keeping requirements for professional services or responding to lawful requests from authorities.
Under UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. This is commonly known as a "subject access request." We will provide this information free of charge within one month of your request.
If you believe any information we hold about you is inaccurate or incomplete, you have the right to request correction. We will update our records promptly upon verification.
Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or when you withdraw consent. However, we may be required to retain certain information for legal or regulatory reasons.
You can request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data or object to our processing activities.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request that we transfer this data directly to another service provider where technically feasible.
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant impacts. We do not currently engage in such automated decision-making.
To exercise any of your data protection rights, please send a written request to [email protected]. Include the following information in your request:
We will respond to your request within one month. In complex cases, we may extend this period by an additional two months, in which case we will inform you of the delay and the reasons for it.
If we cannot fulfill your request, we will explain why and inform you of your right to complain to the supervisory authority.
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
While we take every reasonable precaution to protect your data, no method of transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining the highest standards possible.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Our retention periods are based on:
Consultation records and related financial information are typically retained for seven years in accordance with professional advisory standards. Website usage data is retained for shorter periods based on its purpose.
When data is no longer required, we securely delete or anonymize it to prevent unauthorized access or use.
We primarily store and process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:
If you believe we have not handled your personal data in accordance with data protection law, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: www.ico.org.uk
However, we encourage you to contact us first so we can attempt to resolve any concerns directly.
We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website with an updated revision date.