GDPR Compliance Statement

Last updated: 23 September 2026

Our Commitment to Data Protection

deft-hawk is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations.

Data Controller

For the purposes of data protection law, deft-hawk is the data controller. Our contact details are:

deft-hawk
Unit 47, Green Quarter
Wellington Street
Leeds LS1 4HZ
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The lawful bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for a specific purpose
• Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legal obligation: Processing is necessary for us to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests

Your Data Protection Rights

Under data protection law, you have rights including:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for multiple copies or excessive requests.

Right to Rectification

You have the right to request that we correct information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we delete your personal data in certain circumstances, such as when:

• The personal data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to the processing and there are no overriding legitimate grounds
• The personal data has been unlawfully processed

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Object

You have the right to object to our processing of your personal data in certain circumstances, particularly where we are relying on legitimate interests as the legal basis for processing.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organisation, or directly to you, in certain circumstances.

Right to Withdraw Consent

Where we rely on consent as the legal basis for processing your personal data, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two further months in complex cases. We will inform you of any such extension.

You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive, or we may refuse to comply with your request in these circumstances.

Data Security

We have implemented appropriate technical and organisational security measures to protect your personal data, including:

• Secure server infrastructure with SSL/TLS encryption
• Access controls limiting who can access personal data
• Regular security assessments and updates
• Staff training on data protection principles
• Secure data backup procedures

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with GDPR requirements.

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the ICO
• Adequacy decisions recognising equivalent data protection standards
• Binding corporate rules for organisations with international operations

Data Protection by Design

We implement data protection principles throughout our operations, including:

• Data minimisation: collecting only necessary data
• Purpose limitation: using data only for specified purposes
• Storage limitation: retaining data only as long as necessary
• Accuracy: keeping data accurate and up to date
• Integrity and confidentiality: securing data against unauthorised access

Children's Data

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised date.

Complaints

If you have concerns about how we handle your personal data, please contact us first at [email protected]. We take complaints seriously and will investigate promptly.

You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Contact Our Data Protection Officer

For specific questions about data protection or to exercise your rights, contact us at [email protected] with "Data Protection Enquiry" in the subject line.