GDPR Compliance

Last Updated: September 2026

witty-finch is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we handle your personal data in accordance with these regulations.

1. Data Controller

witty-finch acts as the data controller for the personal information we collect. This means we determine how and why your personal data is processed.

Data Controller:
witty-finch
47 Greenway Lane
London, SW15 3RP
United Kingdom

Email: [email protected]

2. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to Rectification (Article 16)

You have the right to request that we correct any inaccurate personal data or complete any incomplete personal data we hold about you.

Right to Erasure (Article 17)

Also known as the "right to be forgotten", you can request that we delete your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

Right to Restriction of Processing (Article 18)

You can request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object (Article 21)

You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis. We must stop processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making systems.

3. Exercising Your Rights

To exercise any of your data protection rights, please contact us using the details provided above. We will respond to your request within one month. In complex cases or where we receive numerous requests, we may extend this period by up to two months, but we will inform you of any extension within the first month.

We will not charge a fee for most requests. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with such requests.

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Consent (Article 6(1)(a)): Where you have given explicit consent for processing for specific purposes, such as marketing communications.
• Contract (Article 6(1)(b)): Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate interests or those of a third party, except where your interests and fundamental rights override those interests.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation.

5. Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data where appropriate
• Regular testing and evaluation of security measures
• Staff training on data protection
• Access controls and authentication measures
• Secure disposal of data no longer required

6. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach (where required)
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Document all breaches, including the facts, effects, and remedial action taken

7. International Transfers

We do not routinely transfer personal data outside the United Kingdom. Should any transfer be necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

8. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF

Website: ico.org.uk
Helpline: 0303 123 1113

9. Updates to This Information

We may update this GDPR compliance information from time to time to reflect changes in our practices or applicable law. We encourage you to review this page periodically.

10. Further Information

For detailed information about how we collect and use your personal data, please refer to our Privacy Policy. For information about cookies and tracking technologies, please see our Cookie Policy.