GDPR Compliance Statement

Our Commitment to Data Protection

Reed-orca Limited is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we fulfill our obligations as a data controller and processor.

Data Controller Information

Reed-orca Limited acts as the data controller for personal information collected through this website and in the course of providing our services.

Reed-orca Limited
42 Finsbury Square
London EC2A 1PQ
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you explicitly agree to processing for specific purposes
• Contract performance: When processing is necessary to fulfill our contractual obligations to you
• Legal obligation: When required by UK or EU law
• Legitimate interests: When we have valid business reasons that do not override your fundamental rights

Your Rights Under GDPR

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of your request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of your personal data when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Right to Restriction of Processing

You can request that we limit how we use your data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes at any time.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with the following information:

• Your full name and contact details
• Description of your request
• Proof of identity (if we cannot verify your identity through existing records)

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension.

Data Processing Activities

Website Visitors

• Data collected: IP address, browser information, pages visited
• Purpose: Website analytics and security
• Legal basis: Legitimate interests
• Retention: 12 months

Inquiry Submissions

• Data collected: Name, email, company information, inquiry details
• Purpose: Responding to inquiries and providing services
• Legal basis: Consent and contract performance
• Retention: 3 years or until you request deletion

Client Relationships

• Data collected: Contact details, technical specifications, project documentation
• Purpose: Service delivery and contract fulfillment
• Legal basis: Contract performance and legal obligation
• Retention: Duration of contract plus 7 years for legal compliance

Data Security Measures

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and audits
• Staff training on data protection
• Incident response and breach notification procedures

Third-Party Processors

We engage third-party service providers who process data on our behalf. All processors are contractually obligated to:

• Process data only according to our documented instructions
• Implement appropriate security measures
• Maintain confidentiality
• Assist with data subject rights requests
• Delete or return data upon termination of services

International Data Transfers

When we transfer data outside the United Kingdom, we ensure adequate protection through:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by UK authorities
• Appropriate safeguards as required by UK GDPR

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach. We will also notify the Information Commissioner's Office as required by law.

Data Protection Impact Assessments

We conduct data protection impact assessments for processing activities that are likely to result in high risks to individual rights and freedoms.

Record Keeping

We maintain records of our processing activities as required by Article 30 of UK GDPR, including:

• Purposes of processing
• Categories of data subjects and personal data
• Recipients of personal data
• International data transfers
• Retention periods
• Security measures

Contact and Complaints

For questions about our GDPR compliance or to make a complaint about how we handle your data:

Email: [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk