GDPR Compliance

Last updated: January 2024

Our Commitment to Data Protection

isle-fable is committed to protecting your personal data and respecting your privacy rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we fulfil our obligations as a data controller.

Data Controller

isle-fable is the data controller responsible for your personal data. Our contact details are:

Email: [email protected]
Address: Unit 7, Riverbank Studios, 42 Bermondsey Wall East, London SE16 4NW

Lawful Basis for Processing

We process your personal data on the following legal bases:

• Contract: Processing necessary to perform our rental agreement with you
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services
• Legal Obligation: Processing necessary to comply with legal requirements
• Consent: Where you have given specific consent for marketing communications

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a "subject access request." We will respond to your request within one month of receipt.

Right to Rectification

You have the right to request that we correct any inaccurate personal data or complete any incomplete data we hold about you. We aim to respond to rectification requests within one month.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Please note that we may need to retain certain information for legal or contractual obligations.

Right to Restrict Processing

You have the right to request that we restrict processing of your personal data in certain situations, such as when you contest the accuracy of your data or object to processing.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop processing your data for this purpose immediately.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently use automated decision-making processes.

Exercising Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to all legitimate requests within one month. If your request is complex or we receive many requests, we may extend this period by a further two months, but we will notify you of any extension.

Data Transfers

We primarily store and process your data within the UK. If we need to transfer data outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods are determined by:

• The nature of the data and purposes of processing
• Legal and regulatory requirements
• Contractual obligations
• Business needs and legitimate interests

Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication measures
• Regular security assessments
• Staff training on data protection

Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Website: www.ico.org.uk
Telephone: 0303 123 1113

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

Changes to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.