Your data protection rights under UK GDPR
Last updated: August 2024
witty-stone is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations and respect your data protection rights.
witty-stone acts as the data controller for personal information collected through our services. Our contact details are:
We process personal data under the following lawful bases as defined by Article 6 of the UK GDPR:
Processing necessary for the performance of our advisory services contract with you, including managing your case, communicating about appointments, and liaising with relevant bodies on your behalf.
Processing necessary for our legitimate business interests, such as improving our services, managing our business operations, and protecting against fraud, provided these interests do not override your fundamental rights.
Processing necessary to comply with legal requirements, including financial record-keeping obligations and responding to lawful requests from authorities.
Where we rely on consent for specific processing activities, we will obtain your clear, informed consent and you may withdraw it at any time.
Given the nature of benefits advisory services, we may process special category data including health information. We do so under the following conditions:
You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of your request, free of charge in most circumstances.
If you believe any personal data we hold is inaccurate or incomplete, you have the right to request correction. We will respond to rectification requests within one month.
In certain circumstances, you have the right to request deletion of your personal data. This right is not absolute and depends on our legal obligations to retain certain records.
You may request that we limit how we use your data in certain circumstances, such as when you contest its accuracy or object to processing.
Where technically feasible, you have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.
You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
We implement appropriate technical and organisational measures to protect personal data, including:
In the event of a personal data breach, we have procedures in place to:
We do not routinely transfer personal data outside the United Kingdom. If any transfer becomes necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
To exercise any of your data protection rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to valid requests within one month.
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office: