GDPR Compliance

Our commitment to GDPR

elm-den Energy Consultancy operates in full compliance with the UK General Data Protection Regulation and the Data Protection Act 2018. We are committed to protecting the privacy and security of all personal data we process.

Data controller information

Data Controller: elm-den Energy Consultancy
Registered address: Unit 7, Baltic Quarter, 27 Bridgewater Street, Liverpool L1 0AS, United Kingdom
Contact: [email protected]

Lawful basis for processing

We process personal data only when we have a lawful basis to do so:

• Consent: You have explicitly agreed to our processing of your data for specific purposes
• Contract: Processing is necessary to fulfil contractual obligations with you
• Legal obligation: We must process your data to comply with legal requirements
• Legitimate interests: Processing is necessary for our legitimate business interests, provided these do not override your rights

Data protection principles

We adhere to the following principles in all data processing activities:

• Lawfulness, fairness, and transparency: We process data legally, fairly, and openly
• Purpose limitation: We collect data for specific, explicit purposes and do not use it beyond those purposes
• Data minimisation: We collect only the data necessary for our purposes
• Accuracy: We take reasonable steps to ensure personal data is accurate and up to date
• Storage limitation: We retain data only as long as necessary
• Integrity and confidentiality: We implement appropriate security measures to protect data
• Accountability: We can demonstrate compliance with all principles

Your GDPR rights

Under GDPR, you have the following rights regarding your personal data:

Right to be informed

You have the right to know how we collect and use your personal data. This information is provided in our Privacy Policy.

Right of access

You can request a copy of the personal data we hold about you. We will provide this free of charge within one month of your request.

Right to rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or completion.

Right to erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including when data is no longer necessary for its original purpose or when you withdraw consent.

Right to restrict processing

You can request that we limit how we use your data in certain situations, such as when you contest the accuracy of data or object to processing.

Right to data portability

You have the right to receive your personal data in a structured, commonly used format and transmit it to another organisation.

Right to object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Rights related to automated decision making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

How to exercise your rights

To exercise any of these rights, contact us at [email protected]. Please include:

• Your full name and contact information
• Description of the specific right you wish to exercise
• Any relevant details that will help us locate your data

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two months and will inform you of any delay.

Data security measures

We implement appropriate technical and organisational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorised personnel only
• Regular security assessments and updates
• Staff training on data protection obligations
• Secure disposal of data when no longer needed

Data breach procedures

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

International data transfers

We store and process personal data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Complaints

If you believe we have not complied with data protection law, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Updates to this statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Please review this page periodically for the latest information.