GDPR Compliance

Last updated: July 10, 2026

Our Commitment to Data Protection

gloss-gleam.com is committed to protecting your personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. This document outlines how we comply with these regulations.

Data Controller

For the purposes of data protection legislation, gloss-gleam.com is the data controller responsible for your personal information.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you submit an enquiry form, you provide consent for us to process your information to respond to your request
• Legitimate interests: We have a legitimate interest in maintaining records of client enquiries and communications
• Contract: Processing may be necessary for entering into or performing a contract with you

Your Rights Under GDPR

Right to Access

You have the right to request a copy of the personal information we hold about you. This is known as a subject access request.

Right to Rectification

If personal information we hold about you is inaccurate or incomplete, you have the right to have it corrected.

Right to Erasure

In certain circumstances, you have the right to request deletion of your personal data. This right is not absolute and may be limited by legal requirements to retain certain information.

Right to Restrict Processing

You have the right to request that we restrict processing of your personal data in certain circumstances.

Right to Data Portability

You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing of your personal data where we are relying on legitimate interests as the legal basis.

Rights Related to Automated Decision Making

We do not use automated decision making or profiling in our processing of personal data.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us using the information provided on our contact page. We will respond to your request within one month, though this may be extended by up to two months for complex requests.

We may need to verify your identity before responding to certain requests. This is a security measure to ensure that personal data is not disclosed to unauthorized individuals.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection obligations

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Enquiry data: 3 years from date of submission
• Project documentation: 6 years from project completion
• Financial records: As required by HMRC regulations

International Transfers

We do not transfer personal data outside the United Kingdom. All data processing occurs within UK jurisdiction.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and report the breach to the Information Commissioner's Office where required by law.

Complaints

If you believe we have not handled your personal data in accordance with data protection law, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113
Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance statement from time to time. Any changes will be posted on this page with an updated revision date.