GDPR Compliance

Last updated: 1 September 2026

Our Commitment

frosty-ibis is committed to ensuring the security and protection of personal information that we process, and to providing a compliant and consistent approach to data protection. We have implemented this policy to meet our responsibilities under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

frosty-ibis acts as the data controller for personal information collected through this website. This means we determine the purposes and means of processing personal data.

Contact details:
frosty-ibis
47 Clerkenwell Road
London EC1M 5RS
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We only process personal data where we have a lawful basis to do so. The lawful bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for a specific purpose, such as when you submit an enquiry form.
• Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests.

Your Rights Under UK GDPR

Right to be Informed

You have the right to be informed about the collection and use of your personal data. This GDPR page and our Privacy Policy provide this information.

Right of Access

You have the right to request access to your personal data and supplementary information. This is commonly known as a Subject Access Request (SAR).

Right to Rectification

You have the right to have inaccurate personal data rectified, or completed if it is incomplete.

Right to Erasure

You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

Right to Restrict Processing

You have the right to request the restriction or suppression of your personal data under certain circumstances.

Right to Data Portability

You have the right to obtain and reuse your personal data for your own purposes across different services.

Right to Object

You have the right to object to processing based on legitimate interests, direct marketing, and processing for research or statistical purposes.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In certain circumstances, this period may be extended by two further months where requests are complex or numerous.

We do not charge a fee for most requests. However, if your request is clearly unfounded, repetitive, or excessive, we may charge a reasonable fee or refuse to act on the request.

Data Breach Procedures

We have procedures in place to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk, we will also notify the affected individuals.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Website: ico.org.uk

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to individuals. This helps us identify and minimise data protection risks.

International Data Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place. These may include adequacy decisions, standard contractual clauses, or binding corporate rules.