GDPR Compliance

Our Commitment to Data Protection

blossom-ware is committed to protecting your personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. This page outlines how we comply with these regulations and what rights you have regarding your personal information.

Data Controller

blossom-ware acts as the data controller for the personal information we collect through our website and services. We are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently.

Principles of Data Processing

We adhere to the following principles when processing your personal data:

• Lawfulness, fairness, and transparency: We process your data legally and openly, ensuring you understand how and why we use it
• Purpose limitation: We collect your data for specific, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes
• Data minimization: We only collect data that is adequate, relevant, and necessary for the purposes for which it is processed
• Accuracy: We take reasonable steps to ensure your personal data is accurate and kept up to date
• Storage limitation: We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected
• Integrity and confidentiality: We implement appropriate security measures to protect your data from unauthorized access, loss, or damage

Your Data Protection Rights

Right to be Informed

You have the right to know how we collect, use, and share your personal data. Our Privacy Policy provides comprehensive information about our data processing activities.

Right of Access

You can request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request. We will provide this information free of charge within one month of your request.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it.

Right to Erasure

Also known as the right to be forgotten, you can request that we delete your personal data in certain circumstances, such as when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

Right to Restrict Processing

You can request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to our processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You can object to our processing of your personal data where we are relying on legitimate interests as the legal basis for processing. You also have an absolute right to object to processing for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. We do not currently engage in automated decision-making.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. We will respond to your request within one month, though this period may be extended by up to two months if your request is complex.

We may need to verify your identity before processing your request. If we cannot comply with your request, we will explain why.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular security assessments and updates
• Access controls to limit who can view and process personal data
• Staff training on data protection and security
• Confidentiality agreements with third-party service providers

Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

International Data Transfers

We primarily process your personal data within the United Kingdom. If we transfer your data outside the UK, we will ensure appropriate safeguards are in place to protect your information in accordance with UK GDPR requirements.

Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Updates to Our GDPR Compliance

We regularly review our data protection practices to ensure ongoing compliance with UK GDPR. Any significant changes will be reflected in this document and our Privacy Policy.

Complaints

If you are not satisfied with how we have handled your personal data or responded to your requests, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

Contact Information

For any questions about our GDPR compliance or to exercise your data protection rights, please contact us at:

Email: [email protected]
Address: Leeds, United Kingdom