Our Commitment to Data Protection
Savanna Echo is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take seriously our responsibility to protect your personal information and respect your privacy rights.
This page provides detailed information about your rights under data protection law and how we fulfil our obligations as a data controller.
Data Controller Information
For the purposes of data protection law, Savanna Echo is the data controller responsible for your personal information.
Contact Details:
Savanna Echo
14 Cathedral Road
Pontcanna
Cardiff CF11 9LJ
United Kingdom
Email: [email protected]
Your Rights Under UK GDPR
Right to Be Informed
You have the right to be informed about how we collect and use your personal data. We provide this information through our Privacy Policy and this GDPR information page. We explain what data we collect, why we collect it, how we use it, and who we may share it with.
Right of Access
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). Upon receiving a valid request, we will provide:
- Confirmation that your data is being processed
- A copy of your personal data
- Information about the purposes of processing
- The categories of data concerned
- Recipients or categories of recipients
- The retention period or criteria for determining it
We will respond to your request within one month of receipt.
Right to Rectification
You have the right to request correction of inaccurate personal data and completion of incomplete personal data. If you believe any information we hold about you is incorrect or incomplete, please contact us and we will take reasonable steps to verify and correct the information.
Right to Erasure
Also known as the "right to be forgotten," you may request deletion of your personal data where:
- The data is no longer necessary for the purpose it was collected
- You withdraw consent and there is no other legal basis for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
- Erasure is required for compliance with legal obligation
This right is not absolute and may be subject to certain exemptions.
Right to Restrict Processing
You may request that we restrict processing of your personal data where:
- You contest the accuracy of the data (while we verify)
- Processing is unlawful but you oppose erasure
- We no longer need the data but you need it for legal claims
- You have objected to processing (pending verification of grounds)
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. You may also request that we transmit this data directly to another controller where technically feasible.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes. If you object to processing for direct marketing, we will cease such processing immediately. For objections based on legitimate interests, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
You have rights in relation to automated decision-making and profiling. We do not currently engage in automated decision-making that produces legal or similarly significant effects on you. Should this change, we will provide appropriate safeguards and inform you of your rights.
Exercising Your Rights
To exercise any of your rights, please contact us using the details above. To help us process your request efficiently:
- Clearly state which right you wish to exercise
- Provide sufficient information for us to verify your identity
- Specify any particular data or processing activities your request concerns
We will not charge a fee for responding to legitimate requests. However, we may charge a reasonable fee or refuse the request if it is manifestly unfounded or excessive.
Lawful Bases for Processing
We process personal data on the following lawful bases:
- Consent: Where you have provided clear, affirmative consent
- Contractual Necessity: Where processing is necessary to provide services you have requested
- Legitimate Interests: Where processing serves our legitimate business interests without unduly affecting your rights
- Legal Obligation: Where we are required by law to process certain data
Data Security Measures
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest where appropriate
- Access controls limiting data access to authorised personnel
- Regular security assessments and updates
- Staff training on data protection obligations
- Incident response procedures for data breaches
International Data Transfers
We primarily process data within the United Kingdom. Where international transfers occur, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner.
Complaints
If you are dissatisfied with how we have handled your personal data or responded to your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Information
We may update this GDPR information page periodically. Any significant changes will be communicated through our website. We encourage you to review this page regularly to stay informed about your data protection rights.