GDPR Compliance
Last updated: November 2026
Our Commitment to Data Protection
Echo-reed is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we fulfil our obligations under these regulations.
Data Controller
Echo-reed acts as the data controller for personal information collected through our website and business operations. We determine the purposes and means of processing your personal data.
Contact: [email protected]
Lawful Bases for Processing
We process personal data only when we have a lawful basis to do so:
Consent
When you submit enquiry forms, accept cookies, or otherwise provide explicit consent, we process your data based on that consent. You may withdraw consent at any time by contacting us.
Contract Performance
When you commission our heritage conservation services, we process personal data necessary to fulfil contractual obligations, including project delivery, invoicing, and communications.
Legitimate Interests
We may process data based on legitimate interests, such as improving website functionality, preventing fraud, or maintaining business records. We balance these interests against your rights and freedoms.
Legal Obligation
We process data when required to comply with legal obligations, such as tax reporting, professional liability requirements, or responding to lawful requests from authorities.
Data Subject Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of Access
You may request confirmation of whether we process your personal data and obtain a copy of that data. We will respond within one month of receiving a valid request.
Right to Rectification
If personal data we hold about you is inaccurate or incomplete, you may request correction. We will rectify the information without undue delay.
Right to Erasure
In certain circumstances, you may request deletion of your personal data. This right applies when data is no longer necessary for the purposes collected, consent is withdrawn, or processing is unlawful. Exceptions apply where we have legal obligations to retain data.
Right to Restriction
You may request that we limit processing of your personal data in specific situations, such as when accuracy is contested or processing is unlawful but you oppose erasure.
Right to Data Portability
Where processing is based on consent or contract performance and carried out by automated means, you may receive your personal data in a structured, commonly used format and request transmission to another controller.
Right to Object
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
How to Exercise Your Rights
To exercise any of these rights, contact us at [email protected]. Please provide sufficient information to allow us to verify your identity and locate your data.
We will respond to requests within one month. In complex cases, this period may be extended by two additional months, and we will inform you of the extension and reasons.
Data Security Measures
We implement appropriate technical and organisational measures to ensure data security:
- Encryption of data in transit and at rest where appropriate
- Access controls limiting who can view personal data
- Regular security assessments and updates
- Staff training on data protection obligations
- Secure disposal procedures for data no longer required
Data Breach Procedures
In the event of a personal data breach, we will assess the risk to individuals and, where required, notify the Information Commissioner's Office within 72 hours. If the breach poses a high risk to your rights and freedoms, we will also notify you directly.
Third-Party Processing
Where we engage third-party processors to handle personal data on our behalf, we ensure they provide sufficient guarantees regarding data protection. Processors are bound by written contracts specifying data protection obligations.
International Transfers
We primarily process data within the United Kingdom. If data is transferred to countries outside the UK, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.
Data Retention
We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy. Retention periods vary based on data category and legal requirements:
- Enquiry data: Up to two years
- Client project records: Seven years after project completion
- Financial records: Seven years as required by tax law
- Marketing consent: Until consent is withdrawn
Children's Data
Our services are not directed at children under 16. We do not knowingly process personal data of children. If we become aware of such processing, we will delete the data and cease processing.
Complaints and Supervisory Authority
If you believe we have not complied with data protection law, you may lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Policy Updates
We review this GDPR compliance statement regularly and update it as necessary to reflect changes in our processing activities or legal requirements. Material changes will be communicated through our website.