GDPR Compliance Statement
Last Updated: January 2026
Our Commitment to Data Protection
We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations and safeguard your information.
Data Controller
For the purposes of data protection law, we act as the data controller for personal information we collect and process. Our contact details are:
amethyst-fjord
17 Wellington Street
Leeds, LS1 4DG
United Kingdom
Email: [email protected]
Lawful Basis for Processing
We process personal data only when we have a lawful basis to do so under UK GDPR. The lawful bases we rely on include:
Contractual Necessity
Processing is necessary to perform our contract with you, including providing consultation services and managing benefits applications.
Legitimate Interests
Processing is necessary for our legitimate business interests, such as maintaining records, improving our services, and preventing fraud, provided these interests do not override your rights.
Legal Obligation
Processing is necessary to comply with legal obligations, including requirements to maintain records and cooperate with government agencies.
Consent
Where we rely on consent, we ensure it is freely given, specific, informed, and unambiguous. You may withdraw consent at any time.
Your Rights Under UK GDPR
UK GDPR provides you with specific rights regarding your personal data:
Right to Access
You have the right to request a copy of the personal data we hold about you, along with information about how we process it.
Right to Rectification
You can request correction of inaccurate or incomplete personal data.
Right to Erasure
In certain circumstances, you can request deletion of your personal data, such as when it is no longer necessary for the purposes we collected it.
Right to Restriction of Processing
You can request that we limit how we use your data in specific situations, such as when you contest its accuracy.
Right to Data Portability
Where technically feasible, you can request to receive your data in a structured, commonly used format or have it transmitted to another controller.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not use automated decision-making in our services.
How to Exercise Your Rights
To exercise any of your rights, please contact us in writing at:
Email: [email protected]
Post: 17 Wellington Street, Leeds, LS1 4DG, United Kingdom
We will respond to your request within one month. In complex cases, we may extend this period by up to two additional months and will inform you of the extension.
Data Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest
- Regular security assessments and vulnerability testing
- Access controls and authentication mechanisms
- Staff training on data protection principles
- Incident response procedures for data breaches
Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.
International Data Transfers
We process and store data primarily within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.
Data Protection Officer
Due to the nature and scale of our operations, we are not required to appoint a Data Protection Officer. However, all data protection queries should be directed to [email protected]
Children's Privacy
Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such information, please contact us immediately.
Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Policy Updates
We review and update this GDPR compliance statement regularly to ensure it reflects current practices and legal requirements. The date of the last update is shown at the top of this page.