GDPR Compliance

Our Commitment to Data Protection

vale-saga is committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we comply with these regulations and respect your data protection rights.

Data Controller Information

vale-saga acts as the data controller for personal information collected through this website and during the provision of our services. As data controller, we determine the purposes and means of processing personal data and are responsible for ensuring compliance with data protection legislation.

Lawful Bases for Processing

We only process personal data when we have a valid legal basis to do so. The lawful bases we rely on include:

• Contract: Processing necessary for the performance of a contract with you or to take steps at your request before entering a contract.
• Consent: Where you have given clear consent for us to process your personal data for specific purposes.
• Legitimate Interests: Processing necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests.
• Legal Obligation: Processing necessary for compliance with a legal obligation to which we are subject.

Your Rights Under GDPR

Data protection legislation provides you with specific rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure: In certain circumstances, you can request deletion of your personal data.
• Right to Restrict Processing: You can request limitation of how we use your data in certain circumstances.
• Right to Data Portability: You can request to receive your data in a structured, commonly used format.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision Making: You have rights concerning decisions made solely through automated processing.

Exercising Your Rights

To exercise any of your data protection rights, please contact us using the details provided on our contact page. We will respond to your request within one month. In complex cases or where we receive numerous requests, this period may be extended by a further two months, in which case we will inform you.

There is no fee for exercising your rights unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

Data Protection Principles

We adhere to the core principles of data protection:

• Processing data lawfully, fairly, and transparently
• Collecting data for specified, explicit, and legitimate purposes
• Ensuring data is adequate, relevant, and limited to what is necessary
• Keeping data accurate and up to date
• Retaining data only for as long as necessary
• Processing data securely with appropriate technical and organisational measures

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular assessment of security measures
• Staff training on data protection
• Access controls limiting who can access personal data
• Secure disposal of data no longer required

International Data Transfers

We primarily process personal data within the United Kingdom. If data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with data protection legislation.

Data Breach Procedures

We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

Contact

For any questions regarding our GDPR compliance or to exercise your data protection rights, please contact us through the information provided on our contact page.

Last updated: January 2024