Your rights under UK data protection legislation
Kestrelcliff Property Consultants is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we uphold your rights under this legislation.
Kestrelcliff Property Consultants acts as the data controller for personal information collected through this website and our services. We are responsible for determining how and why personal data is processed.
You have the right to be informed about how we collect and use your personal data. This information is provided in our Privacy Policy and this GDPR compliance statement.
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.
If you believe any personal data we hold is inaccurate or incomplete, you have the right to request correction. We will address valid requests within one month.
Also known as the "right to be forgotten", you may request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected.
You have the right to request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
You have the right to object to processing based on legitimate interests or direct marketing at any time.
We do not currently make any decisions based solely on automated processing that produce legal or similarly significant effects.
We process personal data under the following lawful bases:
We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.
We primarily process data within the United Kingdom. Any international transfers are subject to appropriate safeguards as required by UK GDPR.
For organisations of our size, the appointment of a Data Protection Officer is not mandatory. However, our management team maintains oversight of data protection compliance.
To exercise any of your rights under UK GDPR, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to valid requests within one month, although this may be extended by up to two months for complex requests.
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
We may update this GDPR compliance statement periodically. Material changes will be communicated through our website.