GDPR Compliance Statement

Last Updated: August 19, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This statement explains how we comply with data protection principles and your rights under these regulations.

Data Controller

For the purposes of data protection legislation, the data controller is:

saffron-cliff
142 Buchanan Street
Glasgow G1 2LW
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so:

  • Contract performance: Processing necessary to fulfill consulting services you have requested
  • Legitimate interests: Processing necessary for business operations, service improvement, and professional communication
  • Consent: Where you have provided explicit consent for specific processing activities
  • Legal obligation: Processing required to comply with legal and regulatory requirements

Data We Collect

We collect and process the following categories of personal data:

  • Identity data: name, professional title
  • Contact data: email address, organization name, business address
  • Project data: information about your energy systems, facilities, and consulting requirements
  • Technical data: IP address, browser type, device information
  • Communication data: correspondence records, meeting notes, project communications

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within one month of your request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you. We will update records within one month of receiving accurate information.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including when data is no longer necessary for the purposes it was collected, when you withdraw consent, or when you object to processing. Note that we may retain certain data where required by law or for legitimate business purposes such as professional liability requirements.

Right to Restrict Processing

You can request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of data or object to processing.

Right to Data Portability

Where processing is based on consent or contract, and carried out by automated means, you can request transfer of your data to another organization or directly to you in a machine-readable format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing prior to withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

How to Exercise Your Rights

To exercise any of your GDPR rights, contact us at [email protected] with your request. We will respond within one month. We may need to verify your identity before processing requests.

Data Retention

We retain personal data only as long as necessary for the purposes it was collected:

  • Inquiry data with no engagement: 2 years
  • Client project data: duration of engagement plus 7 years for professional liability purposes
  • Marketing consent data: until consent is withdrawn
  • Website technical data: 13 months maximum

Data Security

We implement appropriate technical and organizational measures to ensure data security, including:

  • Secure data storage with access controls
  • Encrypted transmission of sensitive data
  • Regular security assessments
  • Staff training on data protection
  • Incident response procedures

International Transfers

We process and store data within the United Kingdom. If data is transferred internationally, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Data Breach Notification

In the event of a data breach that poses risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of the breach.

Automated Decision Making

We do not use automated decision making or profiling that produces legal or similarly significant effects.

Changes to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised date.