GDPR Information

UK GDPR Compliance

Crimson Heron Energy Consultancy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 in all aspects of data processing.

This page provides specific information about how we handle personal data in accordance with UK GDPR requirements.

Data Controller

Crimson Heron Energy Consultancy is the data controller responsible for personal data collected through this website and during business operations.

Data Controller:
Crimson Heron Energy Consultancy
38 Frederick Street
Jewellery Quarter
Birmingham B1 3HE
United Kingdom

Contact: [email protected]

Personal Data We Process

Categories of Personal Data

• Identity data: Name, job title
• Contact data: Email address, postal address
• Professional data: Company name, business sector, facility information
• Technical data: IP address, browser type, device information
• Usage data: Website interaction patterns, pages viewed
• Communication data: Enquiry content, consultation notes, project correspondence

Purposes and Legal Basis

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for its original purpose
• You withdraw consent (where processing is based on consent)
• You object to processing based on legitimate interests and no overriding grounds exist
• The data was unlawfully processed

Right to Restriction

You can request that we limit how we use your data while a dispute about accuracy or processing legitimacy is resolved.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can receive your data in a structured, commonly used format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We must stop processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of your rights, send a request to:

Email: [email protected]

Postal address: 38 Frederick Street, Jewellery Quarter, Birmingham B1 3HE, United Kingdom

What We Need

To process your request, we may need to verify your identity. Please provide:

• Your full name
• Contact details we have on record
• Specific details about your request

Response Timeframe

We will respond to your request within one month of receipt. In complex cases, we may extend this by a further two months and will notify you of the extension and reasons.

No Fee

Exercising your rights is generally free. We may charge a reasonable fee if requests are manifestly unfounded, excessive, or repetitive.

Data Retention

We retain personal data only as long as necessary for the purposes described or as required by law:

• Active client data: Duration of business relationship plus 7 years (legal and accounting obligations)
• Enquiry data (no project): 2 years from last contact
• Financial records: 7 years (UK tax law requirement)
• Website analytics: 26 months

After retention periods expire, we securely delete or anonymise personal data.

International Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions recognising equivalent data protection standards
• Standard contractual clauses approved by the UK government
• Other legally recognised transfer mechanisms

Data Security

We implement appropriate technical and organisational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection obligations
• Incident response procedures

Data Breach Notification

In the event of a data breach likely to result in a risk to your rights and freedoms, we will:

• Notify the ICO within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk
• Provide information about the nature of the breach and mitigation measures

Children's Data

Our services are directed at businesses, not children. We do not knowingly collect personal data from individuals under 16. If we become aware of such collection, we will delete the data promptly.

Complaints

If you believe we have not handled your personal data properly, please contact us first so we can address your concerns.

You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: www.ico.org.uk
Report online: ico.org.uk/make-a-complaint

Updates to This Information

We may update this GDPR information to reflect changes in our data processing practices or legal requirements. Check the "Last updated" date to see when changes were made.

Further Information

For comprehensive details about our data handling practices, see our Privacy Policy.

For information about cookies, see our Cookies Policy.