Last Updated: September 2024
glen-beacon is committed to protecting the personal data of our clients, website visitors and business contacts in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
As a data controller, we implement appropriate technical and organisational measures to ensure data protection principles are embedded throughout our business operations.
We process personal data in accordance with the following principles:
We process personal data under one or more of the following legal bases:
Where we rely on legitimate interests, we conduct balancing assessments to ensure processing is proportionate and does not infringe on your rights.
Under UK GDPR, you have the following rights regarding your personal data:
You can request confirmation of whether we process your personal data and obtain a copy of that data along with supplementary information about how it is processed.
You can request correction of inaccurate personal data and completion of incomplete data we hold about you.
In certain circumstances, you can request deletion of your personal data, including when:
You can request that we limit how we use your personal data in certain situations, such as when you contest the accuracy of data or object to processing.
Where processing is based on consent or contract performance and carried out by automated means, you can receive your personal data in a structured, commonly used and machine-readable format.
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Should this change, we will implement appropriate safeguards and notify affected individuals.
To exercise any of your data protection rights, contact us at [email protected] or write to:
glen-beacon
14 Charlotte Square
Edinburgh EH2 4DR
United Kingdom
We will respond to requests within one month of receipt. In complex cases, this period may be extended by two additional months, and we will notify you of any extension and explain the reasons.
We do not charge fees for processing rights requests unless they are manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or refuse to act on the request.
We implement appropriate technical and organisational security measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. Where the breach poses a high risk, we will notify affected individuals directly unless we have implemented appropriate technical and organisational protection measures or notification would involve disproportionate effort.
We maintain internal breach notification procedures to ensure the Information Commissioner's Office is informed within 72 hours of becoming aware of qualifying breaches.
While not legally required to appoint a Data Protection Officer due to our organisation size and processing activities, we have designated internal responsibility for data protection compliance. Questions or concerns about how we handle personal data should be directed to [email protected].
We do not transfer personal data outside the United Kingdom. All data processing activities occur within UK jurisdiction using UK-based service providers subject to UK data protection law.
Should international transfers become necessary for business operations, we will implement appropriate safeguards such as standard contractual clauses approved by UK authorities and ensure adequate protection exists in the recipient country.
We engage limited third-party service providers who process personal data on our behalf. These processors are carefully selected and contractually bound to:
We conduct due diligence to ensure processors demonstrate adequate compliance with data protection requirements.
Our services are directed at business organisations and professional audiences. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected such data, we will delete it promptly.
The Information Commissioner's Office (ICO) is the UK supervisory authority for data protection matters. If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the ICO:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
However, we encourage you to contact us first so we can address concerns directly and attempt to resolve issues before escalation to the supervisory authority.
We review this GDPR compliance statement regularly and update it as necessary to reflect changes in our data processing activities or legal requirements. The "Last Updated" date indicates when the current version took effect. Significant changes will be communicated to active clients and highlighted on our website.