GDPR Compliance

Last updated: October 2024

Our Commitment to Data Protection

nimble-craft is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the privacy and security of your personal data seriously and have implemented appropriate measures to protect it.

Data Controller

nimble-craft acts as the data controller for personal information collected through this website and in the course of providing our services. As data controller, we determine how and why your personal data is processed.

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by UK GDPR:

• Consent: When you submit an enquiry or opt in to communications
• Contract: When processing is necessary to fulfil our service agreement with you
• Legitimate Interests: For business operations where they do not override your fundamental rights
• Legal Obligation: When we are required to comply with the law

Your Rights Under UK GDPR

You have the following rights concerning your personal data:

Right to Be Informed

You have the right to know how we collect and use your personal data. This information is provided in our Privacy Policy.

Right of Access

You can request a copy of the personal data we hold about you. We will respond to valid requests within one month.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction.

Right to Erasure

Also known as the right to be forgotten, you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose.

Right to Restrict Processing

You can request that we limit how we use your personal data while concerns are being investigated.

Right to Data Portability

Where applicable, you can request your personal data in a structured, commonly used format to transfer to another provider.

Right to Object

You can object to certain types of processing, including processing for direct marketing purposes.

Rights Related to Automated Decision Making

You have rights concerning decisions made solely by automated means. We do not currently use automated decision making that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before processing your request. We aim to respond to all valid requests within one month, though complex requests may take longer with proper notification.

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Secure handling of enquiry data
• Limited access to personal information on a need-to-know basis
• Regular review of data protection practices
• Staff awareness of data protection responsibilities

Data Breach Procedures

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and affected individuals without undue delay where required.

International Transfers

We do not routinely transfer personal data outside the United Kingdom. If such transfers become necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Contact Our Data Protection Lead

For any questions about this GDPR information or to exercise your data protection rights:

nimble-craft
47 Greenview Road
Leeds, LS8 2NP
United Kingdom

Email: [email protected]