GDPR Compliance Statement

Our Commitment to GDPR

sprout-pulse is committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This statement outlines how we uphold data protection principles and respect your rights regarding personal information.

Data Protection Principles

We process personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency in all data processing activities
• Purpose limitation: data is collected for specified, explicit purposes only
• Data minimisation: we collect only information necessary for stated purposes
• Accuracy: we take reasonable steps to ensure data is accurate and up to date
• Storage limitation: data is retained only as long as necessary
• Integrity and confidentiality: appropriate security measures protect personal data
• Accountability: we can demonstrate compliance with these principles

Lawful Basis for Processing

We process personal data only when we have a lawful basis:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary to fulfil contractual obligations with you
• Legal obligation: Processing is necessary to comply with legal requirements
• Legitimate interests: Processing is necessary for legitimate business interests, provided this does not override your rights

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to be Informed

You have the right to clear, transparent information about how we use your personal data. This information is provided in our Privacy Policy and this statement.

Right of Access

You can request copies of your personal data. We will provide this information within one month of your request, free of charge for the first request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update records within one month of notification.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when data is no longer necessary for the purpose collected, or you withdraw consent.

Right to Restrict Processing

You can request limitation of processing in specific situations, such as when you contest data accuracy or object to processing based on legitimate interests.

Right to Data Portability

You can request your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another data controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling. All decisions regarding service provision are made by qualified consultants.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with:

• Your full name and contact details
• Description of the right you wish to exercise
• Any relevant details that help us locate your information

We will respond within one month. If your request is complex or we receive multiple requests, we may extend this period by two months, notifying you of the extension and reasons.

Data Security Measures

We implement appropriate technical and organisational measures including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorised personnel only
• Regular security assessments and updates
• Staff training on data protection responsibilities
• Secure disposal procedures for data no longer required

Data Breach Notification

In the event of a data breach that poses risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR. Notification will include the nature of the breach, likely consequences, and measures taken to address it.

International Data Transfers

We process data within the United Kingdom. If we transfer data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Children's Data

Our services are not directed at individuals under 18. We do not knowingly collect personal data from children. If we become aware we have collected such data, we will delete it promptly.

Data Protection Officer

For questions about our GDPR compliance or to exercise your rights, contact us at:

sprout-pulse
42 Deansgate
Manchester M3 2AY
United Kingdom
[email protected]

Right to Complain

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Policy Updates

We review this statement regularly to ensure continued compliance with GDPR requirements. Updates will be posted on this page with revision dates.