GDPR Compliance Statement

Last Updated: January 15, 2026

Our Commitment to Data Protection

vibrant-thicket is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations and explains your rights as a data subject.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

vibrant-thicket
127 Kingsway
London WC2B 6NH
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The lawful bases we rely on include:

Consent (Article 6(1)(a))

We may process your data when you have given clear consent for us to do so for specific purposes. You have the right to withdraw consent at any time.

Contract Performance (Article 6(1)(b))

We process data when necessary to fulfill our contractual obligations to you, such as providing the services you have requested.

Legal Obligation (Article 6(1)(c))

We may process data when required to comply with legal obligations, such as tax reporting or responding to legal requests.

Legitimate Interests (Article 6(1)(f))

We may process data when necessary for legitimate business interests, provided these interests do not override your fundamental rights and freedoms.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access (Article 15)

You have the right to request confirmation of whether we process your personal data and, if so, to access that data along with information about how it is processed.

Right to Rectification (Article 16)

You can request that we correct any inaccurate personal data we hold about you and complete any incomplete data.

Right to Erasure (Article 17)

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when:

The data is no longer necessary for the purposes for which it was collected
You withdraw consent and there is no other legal ground for processing
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed

Right to Restriction of Processing (Article 18)

You can request that we restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You can object to processing of your personal data when we rely on legitimate interests as the lawful basis. We must stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. We do not currently engage in automated decision-making of this nature.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected] with the following information:

Your full name and contact details
A clear description of your request
Any relevant details that will help us locate your information

We will respond to your request within one month of receipt. In complex cases, we may extend this period by an additional two months and will inform you of any such extension.

Data Processing Principles

We adhere to the following data processing principles as required by GDPR:

Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
Purpose Limitation: We collect data for specified, explicit, and legitimate purposes only
Data Minimization: We collect only data that is adequate, relevant, and limited to what is necessary
Accuracy: We take reasonable steps to ensure data is accurate and kept up to date
Storage Limitation: We retain data only as long as necessary for the stated purposes
Integrity and Confidentiality: We implement appropriate security measures to protect data
Accountability: We take responsibility for our data processing and can demonstrate compliance

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of personal data in transit and at rest
Regular security assessments and updates
Access controls and authentication procedures
Staff training on data protection principles
Incident response and breach notification procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR.

International Data Transfers

If we transfer your personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

Standard contractual clauses approved by the ICO
Transfers to countries with adequacy decisions
Other legally approved transfer mechanisms

Right to Lodge a Complaint

If you are not satisfied with how we have handled your personal data or believe we have not complied with data protection law, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk
Helpline: 0303 123 1113

Changes to This Statement

We may update this GDPR compliance statement from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised date.

Contact Us

If you have questions about our GDPR compliance or data protection practices, please contact us at [email protected]