GDPR Compliance Statement

Our Commitment to GDPR

phantom-axle is committed to compliance with the General Data Protection Regulation (GDPR) and UK data protection legislation. This statement outlines how we uphold data protection principles in all our operations.

Data Protection Principles

We process personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency in all data processing activities
• Purpose limitation ensuring data is collected for specified, explicit, and legitimate purposes
• Data minimization collecting only information necessary for our stated purposes
• Accuracy maintaining correct and up-to-date personal information
• Storage limitation retaining data only as long as required
• Integrity and confidentiality implementing appropriate security measures
• Accountability demonstrating compliance through documentation and policies

Lawful Bases for Processing

We process personal data under the following lawful bases:

• Legitimate interests in conducting business operations and maintaining client relationships
• Contract performance when providing services
• Legal obligations requiring compliance with regulations
• Consent obtained explicitly for specific processing activities

Individual Rights Under GDPR

We respect and facilitate the exercise of your rights:

• Right to be informed about data collection and use
• Right of access to personal information we hold
• Right to rectification of inaccurate data
• Right to erasure in applicable circumstances
• Right to restrict processing
• Right to data portability
• Right to object to certain processing
• Rights related to automated decision-making and profiling

Data Subject Requests

Individuals may submit requests to exercise their rights by contacting us at the email address provided on our contact page. We will respond to valid requests within one month, or two months for complex requests, as permitted by regulation.

We may request additional information to verify identity before processing requests involving personal data access or deletion.

Data Security

We implement technical and organizational measures appropriate to the risks posed by processing, including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Staff training on data protection responsibilities
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a personal data breach likely to result in risk to individual rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Affected individuals will be informed directly where the breach poses high risk.

Third-Party Processors

Where we engage third-party processors to handle personal data, we ensure:

• Appropriate data processing agreements are in place
• Processors provide sufficient guarantees of GDPR compliance
• Processing occurs only on our documented instructions
• Appropriate security measures are maintained

International Transfers

When personal data is transferred outside the UK and European Economic Area, we implement appropriate safeguards such as standard contractual clauses or adequacy decisions to ensure GDPR-level protection.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters, if you believe our processing of personal data violates applicable regulations.

Contact for Data Protection Matters

For questions regarding our GDPR compliance or to exercise your data protection rights, contact us using the details provided on our contact page.