GDPR Compliance

Our Commitment to GDPR

keen-raven is committed to ensuring the security and protection of the personal information that we process, and to providing a compliant and consistent approach to data protection. We have implemented robust policies and procedures to protect personal data, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

keen-raven acts as a Data Controller for the personal information we collect and process. As a Data Controller, we are responsible for determining the purposes and means of processing personal data and ensuring compliance with data protection legislation.

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The lawful bases we rely upon include:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose
• Contract: Where processing is necessary for the performance of a contract to which you are a party
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights

Your Data Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to obtain confirmation as to whether personal data concerning you is being processed, and where that is the case, access to the personal data and information about how it is being processed.

Right to Rectification

You have the right to have inaccurate personal data rectified without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed.

Right to Erasure

You have the right to request the erasure of personal data concerning you without undue delay, where one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected
• You withdraw consent on which the processing is based
• You object to the processing and there are no overriding legitimate grounds
• The personal data has been unlawfully processed

Right to Restriction of Processing

You have the right to obtain restriction of processing where:

• The accuracy of the personal data is contested
• The processing is unlawful and you oppose erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

You have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance.

Right to Object

You have the right to object to processing of personal data concerning you based on legitimate interests, including profiling. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing.

Data Protection Measures

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of security measures
• Staff training on data protection obligations
• Access controls and authentication procedures
• Secure data storage and backup systems
• Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

International Data Transfers

Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your personal data.

Exercising Your Rights

To exercise any of your data protection rights, please contact us:

keen-raven
47 Clerkenwell Road
London EC1M 5RS
Email: [email protected]

We will respond to your request within one month of receipt. In certain circumstances, this period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Supervisory Authority

If you are not satisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk