GDPR Compliance Statement

Last Updated: June 17, 2026

1. Our Commitment

copper-heath is committed to protecting personal data in accordance with the UK General Data Protection Regulation and Data Protection Act 2018. This statement outlines how we comply with data protection principles and respect your privacy rights.

2. Data Controller Information

copper-heath
127 Finnieston Street
Glasgow G3 8HB
United Kingdom
Email: [email protected]

3. Data Protection Principles

We ensure that personal data is:

• Processed Lawfully, Fairly, and Transparently: We provide clear information about how we collect and use your data
• Collected for Specific Purposes: Data is gathered only for defined, legitimate business purposes
• Adequate and Relevant: We collect only what is necessary for our stated purposes
• Accurate and Current: We maintain processes to update and correct information
• Retained Appropriately: Data is kept only as long as necessary for its intended purpose
• Processed Securely: We implement appropriate technical and organizational security measures

4. Your Data Protection Rights

Under GDPR, you have comprehensive rights regarding your personal data:

4.1 Right of Access

You can request confirmation of whether we process your personal data and obtain a copy of that data. We provide this information free of charge within one month of verification.

4.2 Right to Rectification

If you believe your personal data is inaccurate or incomplete, you may request corrections or additions.

4.3 Right to Erasure

You may request deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent and no other legal basis exists for processing
• You object to processing and no overriding legitimate grounds exist
• The data has been processed unlawfully

This right may be limited by legal obligations requiring data retention.

4.4 Right to Restriction of Processing

You may request limitation of how we process your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

4.5 Right to Data Portability

For data processed based on consent or contractual necessity, you may request to receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

4.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

4.7 Rights Related to Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

5. How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with:

• Your full name and contact details
• Specific right you wish to exercise
• Any relevant details to help us locate your information

We will respond within one month, which may be extended by two additional months for complex requests. We may request additional information to verify your identity before processing requests.

6. Data Security Measures

We implement comprehensive security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Employee training on data protection obligations
• Incident response procedures for potential data breaches

7. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, potential consequences, and measures taken to address it.

8. Third-Party Processing

When we engage service providers who process personal data on our behalf, we ensure:

• Contractual agreements specify data protection obligations
• Processors implement appropriate security measures
• Processing occurs only on our documented instructions
• Subprocessors are approved and subject to equivalent obligations

9. International Data Transfers

Data is primarily processed within the United Kingdom. Any transfers outside the UK are protected through approved transfer mechanisms such as standard contractual clauses or adequacy decisions.

10. Complaints and Supervisory Authority

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

11. Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Significant changes will be communicated appropriately.

12. Contact for Data Protection Matters

For questions about our GDPR compliance or to exercise your rights, contact us at [email protected].