GDPR Compliance and Data Rights

Last Updated: July 2026

Our Commitment to Data Protection

ash-cypress is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take your privacy seriously and have implemented comprehensive measures to protect your personal information.

This page explains your data protection rights and how we fulfil our obligations under GDPR.

Data Controller Information

ash-cypress is the data controller for personal information collected through our website and services.

ash-cypress
15 Marylebone Lane
London W1U 2NE
United Kingdom
Email: [email protected]

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will provide this information free of charge within one month of your request.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to your request within one month.

Right to Erasure

Also known as the "right to be forgotten," this allows you to request deletion of your personal data in certain circumstances, including:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent and there is no other legal basis for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

Please note that we may need to retain certain information for legal or regulatory compliance.

Right to Restriction of Processing

You can request that we restrict how we use your personal data in certain situations:

  • While we verify the accuracy of contested data
  • When processing is unlawful but you prefer restriction to erasure
  • When we no longer need the data but you need it for legal claims
  • While we verify whether our legitimate grounds override your objection

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. This applies to data you provided with consent or for contract performance, and where processing is automated.

Right to Object

You can object to processing of your personal data based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

You have an absolute right to object to processing for direct marketing purposes at any time.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects. We do not currently use automated decision-making systems.

How to Exercise Your Rights

To exercise any of your data protection rights, contact us at:

Email: [email protected]
Post: ash-cypress, 15 Marylebone Lane, London W1U 2NE, United Kingdom

Verification Process

To protect your privacy, we may need to verify your identity before fulfilling your request. This may require:

  • Proof of identity (e.g., driving licence, passport)
  • Proof of address
  • Verification of previous interactions with us

Response Timeframes

We will respond to all requests within one month of verification. If your request is complex or we receive multiple requests from you, we may extend this period by two months and will inform you of the extension.

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so:

  • Consent: You have given clear consent for us to process your data for a specific purpose
  • Contract: Processing is necessary to fulfil a contract with you or to take steps before entering into a contract
  • Legal Obligation: Processing is necessary to comply with legal requirements
  • Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided your rights do not override those interests

Data Security Measures

We implement appropriate technical and organisational measures to ensure data security:

  • Encryption of data in transit and at rest
  • Regular security assessments and audits
  • Access controls and authentication systems
  • Staff training on data protection principles
  • Incident response procedures
  • Regular backup and recovery testing

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

  • Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
  • Inform affected individuals without undue delay if the breach poses a high risk
  • Provide clear information about the nature of the breach and recommended actions

International Data Transfers

We primarily process data within the United Kingdom. If we need to transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

  • Adequacy decisions
  • Standard contractual clauses
  • Binding corporate rules

We will not transfer your data internationally without ensuring adequate protection.

Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately.

Data Protection Officer

For data protection enquiries, contact us at [email protected]. We will respond to your query within a reasonable timeframe.

Right to Complain

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.

Updates to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Please review this page regularly to stay informed about your data rights.