GDPR Compliance

Our Commitment to Data Protection

nano-rift Culinary Ltd recognises the importance of protecting personal data and is committed to processing it responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This document outlines the specific measures we take to ensure compliance with data protection law and explains how you can exercise your rights as a data subject.

Data Protection Principles

We adhere to the core principles set out in data protection legislation:

• Lawfulness, fairness, and transparency: We process personal data lawfully and in a manner that is fair and transparent to data subjects
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes
• Data minimisation: We ensure that personal data is adequate, relevant, and limited to what is necessary
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date
• Storage limitation: We retain personal data only for as long as necessary for the purposes for which it was collected
• Integrity and confidentiality: We process personal data securely, protecting against unauthorised processing, accidental loss, destruction, or damage
• Accountability: We take responsibility for compliance and can demonstrate adherence to these principles

Lawful Basis for Processing

We only process personal data when we have a valid lawful basis to do so. The lawful bases we rely upon include:

Contractual Necessity

We process data where necessary to perform a contract with you or to take pre-contractual steps at your request. This includes processing booking information for cooking classes, project details for recipe development work, and contact information for service delivery.

Legitimate Interests

We may process data based on our legitimate business interests, provided these do not override your fundamental rights. Examples include analysing website usage to improve our services and maintaining records for business administration purposes. We conduct legitimate interest assessments where appropriate.

Legal Obligation

We process certain data to comply with legal requirements, such as maintaining financial records for tax purposes and responding to lawful requests from authorities.

Consent

Where required, we obtain your explicit consent before processing. This applies particularly to marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Your Rights Under GDPR

The UK GDPR provides you with specific rights regarding your personal data. We are committed to facilitating the exercise of these rights:

Right of Access

You have the right to obtain confirmation that your data is being processed and to access a copy of that data along with supplementary information about the processing.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete data we hold about you.

Right to Erasure

In certain circumstances, you have the right to request deletion of your personal data. This applies where the data is no longer necessary, you withdraw consent, or you object to processing and there are no overriding legitimate grounds.

Right to Restriction of Processing

You may request that we restrict processing of your data in specific situations, such as while we verify the accuracy of data you have contested.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.

Exercising Your Rights

To exercise any of your data protection rights, please contact us using the details below. We aim to respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, we may need up to two additional months, in which case we will notify you.

We may request specific information to help us confirm your identity before processing your request. This is a security measure to ensure personal data is not disclosed to unauthorised parties.

You will not usually need to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks presented by our processing activities. These measures include:

• Encryption of personal data during transmission and at rest where appropriate
• Regular testing and evaluation of security measures
• Access controls limiting data access to authorised personnel
• Staff training on data protection and security practices
• Secure disposal of data that is no longer required
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a personal data breach, we will follow established procedures to assess and contain the breach. Where required by law, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

If a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

International Data Transfers

We primarily process and store data within the United Kingdom. Where we transfer personal data outside the UK, we ensure that adequate safeguards are in place, such as:

• Transfers to countries with adequate levels of data protection as determined by the UK government
• Use of standard contractual clauses approved by the Information Commissioner
• Other appropriate safeguards as permitted by data protection law

Third-Party Processors

Where we engage third parties to process personal data on our behalf, we ensure appropriate contracts are in place that require the processor to:

• Process data only on our documented instructions
• Ensure persons authorised to process the data are subject to confidentiality obligations
• Implement appropriate security measures
• Assist us in responding to data subject requests
• Delete or return all personal data at the end of the service provision
• Make available information necessary to demonstrate compliance

Record Keeping

We maintain records of our processing activities as required under Article 30 of the UK GDPR. These records include details of processing purposes, data categories, recipient categories, retention periods, and security measures.

Contact Information

For any questions about our GDPR compliance or to exercise your data protection rights, please contact:

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes data protection law. The UK supervisory authority is:

We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us in the first instance.