Your data protection rights under the General Data Protection Regulation
Last updated: January 2024
fern-trail is fully committed to complying with the General Data Protection Regulation (GDPR). We take the protection of your personal data seriously and have implemented appropriate technical and organisational measures to ensure that processing of personal data meets the requirements of the GDPR.
fern-trail acts as the data controller for personal data collected through our website and services. This means we determine the purposes and means of processing your personal data.
Contact details:
fern-trail
14 Berkeley Square
Mayfair, London W1J 6AA
Email: [email protected]
We only process personal data where we have a lawful basis to do so. The lawful bases we rely on include:
Under the GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month.
You have the right to request that we correct any personal data we hold about you that is inaccurate or incomplete.
You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.
You have the right to request that we restrict the processing of your personal data in certain circumstances.
You have the right to request that we transfer your personal data to another organisation, or directly to you, in a structured, commonly used, and machine-readable format.
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
To exercise any of your rights under the GDPR, please contact us at [email protected]. We will respond to your request within one month of receiving it. If your request is complex or we receive numerous requests, we may extend this period by a further two months, but we will inform you if this is the case.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, and the applicable legal requirements.
We do not routinely transfer personal data outside the European Economic Area (EEA). Where we do transfer personal data outside the EEA, we ensure appropriate safeguards are in place to protect your data, such as standard contractual clauses approved by the European Commission.
We have implemented appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption, access controls, and regular security assessments.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: www.ico.org.uk
We may update this GDPR notice from time to time. Any changes will be posted on this page with an updated revision date.