GDPR Compliance Statement

Our Commitment to GDPR

Flux-fell is committed to full compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This statement outlines how we uphold your data protection rights and maintain transparent data processing practices.

Data Controller Information

For the purposes of GDPR, Flux-fell acts as the data controller for personal information collected through our website and educational programmes.

Contact details:
Flux-fell
47 Thornhill Crescent
Edinburgh, EH3 7QR
United Kingdom
Email: [email protected]

Lawful Basis for Data Processing

We process personal data only when we have a lawful basis to do so:

• Consent: When you voluntarily provide information through our enquiry forms
• Legitimate interests: To operate our business, respond to enquiries, and improve our services
• Legal obligation: To comply with applicable laws and regulations

Your GDPR Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we are processing your personal data and to receive a copy of that data along with information about how it is being used.

Right to Rectification

You may request correction of any inaccurate personal data we hold about you and completion of any incomplete data.

Right to Erasure (Right to be Forgotten)

Under certain circumstances, you have the right to request deletion of your personal data, including when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You have the right to request that we restrict processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you. We do not currently engage in automated decision-making.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

When submitting a request, please provide:

• Sufficient information to identify you
• Specification of which right(s) you wish to exercise
• Any relevant details to help us locate your data

Data Protection Principles

In accordance with GDPR, we ensure that personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept only for as long as necessary
• Processed in a manner that ensures appropriate security

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls limiting data access to authorized personnel
• Staff training on data protection requirements

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required, report the breach to the relevant supervisory authority within 72 hours of becoming aware of it.

International Data Transfers

We primarily process data within the United Kingdom and European Economic Area. Any transfers of personal data outside these regions will be protected by appropriate safeguards in accordance with GDPR requirements.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Specific retention periods are detailed in our Privacy Policy.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. In the UK, the relevant authority is:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: ico.org.uk

Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised date.

Questions and Concerns

If you have questions about our GDPR compliance or wish to exercise your data protection rights, please contact us at [email protected].