About GDPR
The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on 25 May 2018. It applies to all organisations that process the personal data of individuals in the European Union and the United Kingdom.
True-cliff is committed to complying with all applicable data protection regulations, including GDPR and the UK Data Protection Act 2018.
Our Role as Data Controller
True-cliff acts as a data controller for the personal information we collect directly from you when you use our website or engage our services. As a data controller, we determine the purposes and means of processing your personal data.
For certain services, we may also act as a data processor when handling information on behalf of our clients. In these cases, we process data only according to our clients' instructions and applicable agreements.
Your Rights Under GDPR
Under GDPR, you have the following rights regarding your personal data:
Right to Access
You have the right to request copies of your personal data. We may charge a small fee for this service if the request is manifestly unfounded or excessive.
Right to Rectification
You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete information you believe is incomplete.
Right to Erasure
You have the right to request that we erase your personal data, under certain conditions. This is also known as the "right to be forgotten".
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data, under certain conditions.
Right to Object to Processing
You have the right to object to our processing of your personal data, under certain conditions, particularly where we rely on legitimate interests as our legal basis.
Right to Data Portability
You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
Exercising Your Rights
To exercise any of these rights, please contact our Data Protection Officer. We will respond to your request within one month, although we may extend this period by up to two months for complex requests.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights.
Lawful Basis for Processing
We only process personal data where we have a lawful basis to do so. The lawful bases we rely on include:
- Consent: You have given clear consent for us to process your personal data for a specific purpose
- Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
- Legal obligation: Processing is necessary for us to comply with the law
- Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests
Data Protection Measures
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data where appropriate
- Regular security assessments
- Staff training on data protection
- Access controls and authentication procedures
- Regular backup procedures
- Incident response procedures
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
Supervisory Authority
You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates applicable data protection laws. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Contact Our Data Protection Officer
If you have any questions about our GDPR compliance or wish to exercise your rights, please contact:
Data Protection Officer
True-cliff
47 Beaumont Street
London, W1G 6DT
United Kingdom
Email: [email protected]