GDPR Information

1. Our Commitment to Data Protection

Serene-prairie is committed to protecting your personal data and respecting your privacy. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which set out the requirements for how organisations must handle personal data.

2. Data Controller

For the purposes of UK GDPR, the data controller is:

Serene-prairie
47 Kensington Court
London, W8 5DP
United Kingdom

Email: [email protected]

3. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to be informed about how we collect and use your personal data. This information is provided in our Privacy Policy and this GDPR notice.

Right of Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.

Right to Rectification

You have the right to have inaccurate personal data corrected or completed if it is incomplete. We will respond to valid requests within one month.

Right to Erasure

You have the right to request the deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose it was originally collected
• You withdraw consent (where consent was the basis for processing)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of your data or object to our processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transfer your data directly to another organisation where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making processes.

4. How to Exercise Your Rights

To exercise any of your rights under UK GDPR, please contact us:

• Email: [email protected]
• Post: 47 Kensington Court, London, W8 5DP, United Kingdom

We may need to verify your identity before processing your request. We will respond to valid requests within one month, though this may be extended by two further months for complex requests.

5. Data We Collect

We collect and process the following categories of personal data:

• Identity data: Name
• Contact data: Email address
• Service data: Information about services you have enquired about or purchased
• Technical data: IP address, browser type, device information
• Usage data: Information about how you use our website

6. Legal Basis for Processing

We process your personal data on one or more of the following legal bases:

• Consent: You have given clear consent for us to process your personal data for a specific purpose
• Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests
• Legal obligation: Processing is necessary to comply with the law

7. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Secure hosting with encryption
• Access controls limiting who can access personal data
• Regular security assessments
• Staff training on data protection

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods vary based on the type of data and purpose of processing.

9. International Transfers

We do not routinely transfer personal data outside the United Kingdom. If we do transfer data internationally, we will ensure appropriate safeguards are in place to protect your data in accordance with UK GDPR requirements.

10. Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Website: ico.org.uk

11. Updates to This Notice

We may update this GDPR notice from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this notice periodically.