GDPR Compliance

Last updated: September 2026

Our Commitment to GDPR Compliance

amberpuffin is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the protection of personal data seriously and have implemented measures to ensure that any personal information entrusted to us is processed lawfully, fairly, and transparently.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

amberpuffin
47 Piccadilly Gardens
Manchester, M1 2AP
United Kingdom

Email: [email protected]

Principles of Data Processing

We adhere to the following principles when processing personal data:

• Lawfulness, Fairness, and Transparency: We process data only where we have a legitimate legal basis and communicate clearly with data subjects about how their data is used
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes
• Data Minimisation: We collect only the personal data that is necessary for the stated purposes
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date
• Storage Limitation: We retain personal data only for as long as necessary for the purposes for which it was collected
• Integrity and Confidentiality: We implement appropriate security measures to protect personal data against unauthorised processing, loss, or damage
• Accountability: We maintain records of our processing activities and can demonstrate compliance with these principles

Your Rights Under GDPR

The UK GDPR provides you with specific rights regarding your personal data. We are committed to facilitating the exercise of these rights:

Right of Access

You have the right to obtain confirmation as to whether we process your personal data and, if so, to access that data along with information about how it is processed.

Right to Rectification

You have the right to request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure

In certain circumstances, you have the right to request deletion of your personal data, including where it is no longer necessary for the purposes for which it was collected or where you withdraw consent.

Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, we will cease such processing immediately.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us using the details above. We will respond to your request within one month. In complex cases or where we receive a high volume of requests, this period may be extended by up to two months, and we will inform you accordingly.

We may request proof of identity before processing your request to ensure we do not disclose personal data to unauthorised parties.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also communicate the breach to affected individuals without undue delay.

International Data Transfers

Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the Information Commissioner's Office or adequacy decisions by the UK Government.

Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF

Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.