sprout-field Ltd is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we fulfil our obligations under these regulations.
Data Controller
sprout-field Ltd is the data controller for personal data collected through this website and in the course of providing our consultancy services. We determine the purposes and means of processing personal data.
Contact details:
sprout-field Ltd
47 Victoria Street
Bristol BS1 6AD
[email protected]
Lawful Basis for Processing
We only process personal data when we have a lawful basis to do so. The bases we rely on include:
- Consent: You have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications.
- Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
- Legal obligation: Processing is necessary for us to comply with the law.
- Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests.
Your Data Protection Rights
Under UK GDPR, you have the following rights:
Right of Access
You have the right to request copies of your personal data. We may charge a small fee for this service if requests are manifestly unfounded or excessive.
Right to Rectification
You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
Right to Erasure
You have the right to request that we erase your personal data under certain conditions, such as when the data is no longer necessary for the purpose it was collected.
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data under certain conditions.
Right to Object to Processing
You have the right to object to our processing of your personal data under certain conditions, including processing for direct marketing purposes.
Right to Data Portability
You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions.
How to Exercise Your Rights
To exercise any of these rights, please contact us using the details provided above. We aim to respond to all legitimate requests within one month. If your request is particularly complex, we may require an additional two months, in which case we will notify you.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where appropriate, we will also notify affected individuals directly.
International Data Transfers
We primarily process data within the United Kingdom. Where we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
Data Protection Impact Assessments
For processing operations that are likely to result in a high risk to individuals, we conduct Data Protection Impact Assessments to identify and minimise data protection risks.
Complaints
If you are unsatisfied with our response to any data protection issue, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Last updated: January 2024