GDPR Compliance Statement

Last updated: 14 July 2026

Our Commitment to Data Protection

spry-cove is committed to protecting your personal data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we fulfill our obligations as a data controller and the rights available to you as a data subject.

Data Controller Information

For the purposes of UK GDPR, the data controller is:

spry-cove
42 Wellington Street
Edinburgh, EH7 4GB
United Kingdom
Email: [email protected]

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

1. Right to Be Informed

You have the right to clear, transparent information about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR statement.

2. Right of Access

You can request a copy of all personal data we hold about you. This is known as a Subject Access Request (SAR). We will provide this information within one month of your request, free of charge, unless the request is manifestly unfounded or excessive.

3. Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected or updated. We will respond to your rectification request within one month.

4. Right to Erasure

Also known as the "right to be forgotten," this allows you to request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent on which processing is based
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required for compliance with a legal obligation

Please note that this right is not absolute, and we may need to retain certain information for legal or operational reasons.

5. Right to Restrict Processing

You can request that we limit how we use your personal data while a dispute is being resolved or while we verify the accuracy of your data.

6. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.

7. Right to Object

You can object to processing of your personal data where we rely on legitimate interests as the legal basis. You also have an absolute right to object to processing for direct marketing purposes.

8. Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not currently engage in automated decision-making.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected] with the following information:

• Your full name and email address associated with our services
• A clear description of which right you wish to exercise
• Proof of identity (to prevent unauthorized access to your data)
• Any specific details relevant to your request

We will respond to your request within one month. In complex cases, we may extend this period by an additional two months, but we will inform you of any such extension.

Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by UK GDPR:

• Consent: You have explicitly agreed to our processing for specific purposes
• Contract: Processing is necessary to fulfill our contractual obligations to you
• Legal Obligation: Processing is required to comply with UK law
• Legitimate Interests: Processing is necessary for our legitimate business interests, balanced against your rights

Data Protection Principles

We ensure that all personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Retained only for as long as necessary
• Processed securely with appropriate technical measures

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and vulnerability testing
• Access controls limiting data access to authorized personnel only
• Staff training on data protection obligations
• Incident response procedures for data breaches

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. Where the breach poses a high risk, we will inform you within 72 hours. We will also report qualifying breaches to the Information Commissioner's Office as required by law.

International Data Transfers

If we transfer your data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the UK authorities
• Adequacy decisions recognizing equivalent data protection standards
• Other legally approved transfer mechanisms

Third-Party Processing

When we engage third-party service providers to process data on our behalf, we ensure they are bound by data processing agreements that meet UK GDPR requirements, including obligations regarding security, confidentiality, and data protection principles.

Complaints and Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Any material changes will be communicated through our website and, where appropriate, via email.

Contact Us

For any questions about our GDPR compliance or to exercise your data protection rights, please contact us at [email protected].