GDPR Compliance

Our Commitment to Data Protection

spire-magpie is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations and what rights you have regarding your personal information.

Data Controller Information

spire-magpie acts as the data controller for personal information we collect through our website and consultation services. We are responsible for deciding how and why your personal data is processed.

Contact: [email protected]
Address: 47 Bridgewater Street, Liverpool L1 0AY, United Kingdom

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so. The lawful bases we rely on include:

• Contract: Processing is necessary to fulfill our consultation services agreement with you
• Legal Obligation: Processing is necessary to comply with laws and regulations governing our services
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights and freedoms
• Consent: You have given clear consent for us to process your personal data for specific purposes

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to clear, transparent information about how we use your personal data. This is provided through our privacy policy and this GDPR compliance page.

Right of Access

You have the right to request access to the personal data we hold about you. This is commonly known as a "subject access request." We will provide you with a copy of your personal data within one month of receiving your request, free of charge.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. We will respond to your request within one month.

Right to Erasure

Also known as the "right to be forgotten," you have the right to request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose we collected it
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

This right is not absolute. We may need to retain certain data to comply with legal obligations or for the establishment, exercise, or defense of legal claims.

Right to Restrict Processing

You have the right to request that we restrict how we use your personal data in certain situations, such as:

• You contest the accuracy of the data while we verify it
• Processing is unlawful but you don't want the data erased
• We no longer need the data but you need it for legal claims
• You have objected to processing while we verify our legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller. This right applies when processing is based on consent or contract and is carried out by automated means.

Right to Object

You have the right to object to processing of your personal data when we rely on legitimate interests as the lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not engage in automated decision-making or profiling.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. Please include the following information in your request:

• Your full name and contact details
• A description of the right you wish to exercise
• Any additional information that will help us locate your data or fulfill your request

We will respond to your request within one month. In complex cases, we may extend this period by two additional months, in which case we will inform you and explain the reason for the delay.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Staff training on data protection and security
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office within 72 hours of becoming aware of the breach where required by law.

International Data Transfers

We primarily store and process your data within the United Kingdom. If we transfer your data outside the UK, we will ensure appropriate safeguards are in place to protect your data in accordance with UK GDPR requirements.

Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Updates to This Information

We may update this GDPR compliance information from time to time to reflect changes in our practices or legal requirements. Please check this page periodically for updates.