Our Commitment to Data Protection
cosmic-saga is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise the importance of protecting your personal data and maintaining your trust in how we handle your information.
Data Controller
For the purposes of data protection legislation, cosmic-saga is the data controller responsible for your personal data. Our contact details are:
cosmic-saga
42 Princes Street
Edinburgh EH2 2BY
United Kingdom
Email: [email protected]
Your Rights Under UK GDPR
The UK GDPR provides you with specific rights regarding your personal data. We are committed to facilitating the exercise of these rights:
Right to Be Informed
You have the right to be informed about the collection and use of your personal data. Our Privacy Policy provides comprehensive information about how we process your data, our legal bases for processing, and how long we retain your information.
Right of Access
You have the right to request access to your personal data. You can request a copy of the personal information we hold about you, known as a Subject Access Request (SAR). We will respond to valid requests within one month of receipt.
Right to Rectification
You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data. We will respond to such requests within one month.
Right to Erasure
Also known as the "right to be forgotten," you may request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose. This right is not absolute and may be subject to legal retention requirements.
Right to Restrict Processing
You have the right to request that we restrict or suppress the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller. This applies to data processed by automated means based on your consent or a contract.
Right to Object
You have the right to object to processing of your personal data in certain circumstances, including processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
You have rights related to automated decision-making, including profiling. We do not currently engage in solely automated decision-making that produces legal effects concerning you.
How to Exercise Your Rights
To exercise any of your data protection rights, please contact us using the details provided above. We may need to verify your identity before processing your request. We will respond to all legitimate requests within one month, although this period may be extended by two further months for complex or numerous requests.
There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.
Data Protection Principles
We adhere to the following data protection principles:
- Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner
- Purpose limitation: We collect data for specified, explicit, and legitimate purposes
- Data minimisation: We collect only data that is adequate, relevant, and necessary
- Accuracy: We keep personal data accurate and up to date
- Storage limitation: We retain data only as long as necessary
- Integrity and confidentiality: We ensure appropriate security of personal data
- Accountability: We are responsible for and able to demonstrate compliance
International Transfers
We do not routinely transfer personal data outside the United Kingdom. Should any transfer become necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
Data Breaches
We have procedures in place to detect, report, and investigate personal data breaches. In the event of a breach likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and, where required, notify affected individuals without undue delay.
Complaints
If you have concerns about how we handle your personal data, we encourage you to contact us first so we can address your concerns. You also have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Information
We may update this GDPR information from time to time to reflect changes in our practices or legal requirements. The date of the most recent update will be noted at the top of this page.