Advertising content

GDPR Compliance

Our commitment to protecting your data rights

Overview

slate-reef is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we uphold your data protection rights and our responsibilities as a data controller.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

slate-reef
27 Bloomsbury Square
London WC1A 2RL
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We only process personal data when we have a lawful basis to do so. The lawful bases we rely on include:

1. Consent

Where you have given clear, informed consent for us to process your personal data for specific purposes. You may withdraw consent at any time by contacting us.

2. Contract

Processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract (e.g., providing historical consultation services you've requested).

3. Legal Obligation

Processing is necessary to comply with legal obligations to which we are subject (e.g., record-keeping requirements, tax obligations).

4. Legitimate Interests

Processing is necessary for our legitimate business interests or those of a third party, except where your rights and freedoms override those interests. Our legitimate interests include operating our business effectively, improving our services, and maintaining security.

Your Rights Under UK GDPR

Right to Be Informed

You have the right to clear, transparent information about how we use your personal data. We provide this through our Privacy Policy and this GDPR page.

Right of Access

You can request access to your personal data we hold. This is commonly known as a "subject access request." We will provide you with a copy of your data free of charge within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected. We will make amendments within one month and notify any third parties with whom we've shared the data.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

  • The data is no longer necessary for the purposes it was collected
  • You withdraw consent (where processing was based on consent)
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed
  • The data must be erased to comply with a legal obligation

Right to Restrict Processing

You can request that we restrict processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us by email at [email protected] or by post at the address provided above.

Please include the following information in your request:

  • Your full name and contact details
  • A clear description of the information you're requesting or the right you wish to exercise
  • Any relevant reference numbers or dates if applicable

Response Timeframes

We will respond to your request without undue delay and within one month of receipt. In complex cases, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.

Verification

To protect your privacy and security, we may need to verify your identity before fulfilling your request. We may request additional information to confirm your identity, particularly for access or erasure requests.

Right to Complain

If you believe we have not handled your personal data correctly or you are unhappy with our response to a request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Data Protection Principles

We adhere to the following data protection principles:

  • Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner
  • Purpose limitation: We collect data for specified, explicit, and legitimate purposes
  • Data minimization: We only collect data that is adequate, relevant, and limited to what is necessary
  • Accuracy: We keep personal data accurate and up to date
  • Storage limitation: We retain data only as long as necessary
  • Integrity and confidentiality: We process data securely with appropriate technical and organizational measures
  • Accountability: We take responsibility for compliance and can demonstrate it

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest where appropriate
  • Regular security assessments and updates
  • Access controls and authentication measures
  • Staff training on data protection responsibilities
  • Incident response procedures

Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights, we will also notify you without undue delay.

Third-Party Processors

Where we use third-party service providers who process personal data on our behalf, we ensure:

  • Appropriate contracts are in place (Data Processing Agreements)
  • They provide sufficient guarantees of GDPR compliance
  • They only process data according to our documented instructions
  • They implement appropriate security measures

International Transfers

If we transfer your personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

  • Standard Contractual Clauses approved by the UK authorities
  • Transfers to countries with adequacy decisions
  • Binding Corporate Rules where applicable

Updates to This Page

We may update this GDPR compliance information periodically. Material changes will be communicated through our website. Please review this page regularly to stay informed about how we protect your data.

Last updated: July 21, 2026