Your data protection rights explained
Last updated: January 2024
crimson-snow is committed to protecting your personal data and respecting your privacy rights in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we comply with data protection legislation.
crimson-snow acts as the data controller for the personal information you provide to us. This means we determine the purposes and means of processing your personal data. We are responsible for ensuring your data is handled lawfully, fairly, and transparently.
Under the UK GDPR, you have the following rights regarding your personal data:
You have the right to know how we collect and use your personal data. We provide this information through our Privacy Policy and this GDPR statement.
You can request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond within one month of receiving your request.
If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to such requests within one month.
Also known as the right to be forgotten, you can request deletion of your personal data in certain circumstances, including:
You can request that we limit how we use your data in certain situations, such as when you contest the accuracy of data or object to processing.
Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format.
You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you, unless necessary for a contract, authorised by law, or based on explicit consent.
To exercise any of these rights, please contact us:
crimson-snow
47 Castle Street
Liverpool, L2 9UB
United Kingdom
Email: [email protected]
We may need to verify your identity before processing your request. We aim to respond to all legitimate requests within one month. If your request is complex or you have made multiple requests, we may extend this by a further two months, in which case we will inform you.
We only process personal data when we have a lawful basis to do so. The bases we rely on include:
We implement appropriate technical and organisational measures to protect personal data, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.
When we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or binding corporate rules.
If you are not satisfied with how we handle your data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
We may update this GDPR statement from time to time. We will post any changes on this page with an updated revision date.