GDPR Compliance

Last updated: September 2024

Overview

Alpine Zone is committed to complying with the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018. This page outlines how we meet our obligations as a data controller.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you submit a consultation request or subscribe to communications
• Contractual necessity: When providing services you have engaged us for
• Legitimate interests: For business operations and service improvement

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You may request a copy of the personal information we hold about you. We will respond within one month of receiving a valid request.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of your personal data where there is no compelling reason for continued processing.

Right to Restrict Processing

You may request that we limit how we use your personal data in certain circumstances.

Right to Data Portability

You may request a copy of your personal data in a structured, commonly used format.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

Data Processing Activities

We process personal data for the following activities:

• Responding to consultation enquiries
• Delivering contracted consulting services
• Managing client relationships
• Improving service offerings
• Complying with legal obligations

Data Security Measures

We implement technical and organisational security measures including:

• Encrypted data transmission
• Secure server infrastructure
• Access controls and authentication
• Regular security assessments
• Staff training on data protection

Data Breach Procedures

In the event of a data breach affecting personal information, we will:

• Assess the nature and scope of the breach
• Notify the Information Commissioner's Office within 72 hours if required
• Inform affected individuals without undue delay
• Document the breach and remedial actions taken

International Data Transfers

Personal data is stored and processed within the United Kingdom. We do not transfer personal data outside the UK or European Economic Area.

Automated Decision-Making

We do not use automated decision-making or profiling processes that produce legal effects or significantly impact individuals.

Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal information from children.

Exercising Your Rights

To exercise any of your data protection rights, contact us at [email protected] with your request. We will respond within one month and may request verification of your identity.

Supervisory Authority

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Contact

For questions regarding GDPR compliance or data protection practices, contact [email protected]