GDPR Compliance

Our Commitment to GDPR

We are committed to protecting your personal data and complying with the General Data Protection Regulation. This page outlines how we fulfill our obligations under GDPR and how you can exercise your rights as a data subject.

Data Controller Information

For the purposes of GDPR, the data controller is:

frosty-floor
42 Wellington Industrial Park
Clerkenwell
London EC1M 5RF
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contract Performance: Processing is necessary to fulfill our rental agreements and provide services you have requested.
• Legitimate Interests: We have a legitimate business interest in processing your data to operate our services, prevent fraud, and improve customer experience.
• Legal Obligation: We must process certain data to comply with accounting, tax, and regulatory requirements.
• Consent: Where we rely on consent, you have the right to withdraw it at any time without affecting previous processing.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information within one month of your request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update our records promptly upon verification.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose collected, when you withdraw consent, or when processing is unlawful.

Right to Restriction of Processing

You can request that we limit processing of your data when you contest accuracy, when processing is unlawful but you prefer restriction to erasure, or when you need the data for legal claims.

Right to Data Portability

You can receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

Right Not to Be Subject to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making processes.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will:

• Respond to your request within one month
• Verify your identity to protect against fraudulent requests
• Provide information free of charge unless requests are manifestly unfounded or excessive
• Inform you if we cannot comply with your request and explain the reasons

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments for processing activities that present a high risk to your rights and freedoms. These assessments help us identify and minimize data protection risks.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also report certain breaches to the Information Commissioner's Office within 72 hours of becoming aware.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it promptly.

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk

Updates to GDPR Compliance

We regularly review our data protection practices to ensure ongoing GDPR compliance. Any significant changes to how we process your data will be communicated through our website and Privacy Policy updates.