GDPR Compliance

Last updated: January 2024

Our Commitment to Data Protection

velvet-leap is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the protection of your personal data seriously and have implemented measures to ensure your rights are upheld.

Data Controller

For the purposes of data protection legislation, velvet-leap is the data controller for personal information collected through our website and services.

Contact details:
Email: [email protected]
Address: 42 Rose Street, Edinburgh EH2 3JD, United Kingdom

Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to know how we collect and use your personal data. This information is provided in our Privacy Policy and this GDPR statement.

Right of Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We aim to correct data within one month of receiving a request.

Right to Erasure

Also known as the "right to be forgotten", you may request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the basis for processing)
• You object to processing and there is no overriding legitimate interest
• The data was processed unlawfully

Note that this right is not absolute and may be limited by legal obligations to retain certain data.

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as while we verify the accuracy of data you have contested.

Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to direct marketing at any time.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. velvet-leap does not currently engage in such automated decision-making.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]
Subject line: Data Protection Request

We may need to verify your identity before processing your request. Requests are typically processed free of charge, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contract: Processing necessary to perform our travel services
• Consent: Where you have given clear consent for marketing communications
• Legitimate Interests: For business operations that do not override your rights
• Legal Obligation: Where required by law

Data Retention

We retain personal data only for as long as necessary. Retention periods vary based on the type of data and legal requirements. Booking records are typically kept for seven years for accounting and legal purposes.

International Data Transfers

When we transfer data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including encryption, access controls, and staff training.

Data Breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

Complaints

If you are not satisfied with how we handle your data or your request, you have the right to lodge a complaint with the Information Commissioner's Office:

Website: ico.org.uk
Helpline: 0303 123 1113

Updates

This GDPR statement may be updated periodically. We encourage you to review it regularly for any changes.