GDPR Compliance Information
Last updated: September 11, 2026
garnet-maple is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection legislation. This page outlines your rights and how we comply with GDPR requirements.
Data Controller
garnet-maple acts as the data controller for personal information collected through our website and business operations. We determine the purposes and means of processing your personal data.
Contact details:
Email: [email protected]
Address: 42 Clerkenwell Road, London EC1M 5PS, United Kingdom
Legal Basis for Processing
We process personal data under the following legal bases:
- Consent: When you voluntarily submit enquiry forms or contact us
- Contractual necessity: To provide conservation services you've requested
- Legitimate interests: To improve our services and communicate about relevant offerings
- Legal obligation: To comply with accounting, tax, and regulatory requirements
Your GDPR Rights
Under GDPR, you have the following rights regarding your personal data:
Right to Access
You can request confirmation of whether we process your personal data and obtain a copy of that data.
Right to Rectification
You can request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure
You can request deletion of your personal data in certain circumstances, including when data is no longer necessary for the purposes collected or when you withdraw consent.
Right to Restrict Processing
You can request we limit processing of your personal data in specific situations, such as when you contest data accuracy.
Right to Data Portability
You can request transfer of your personal data in a structured, commonly used format to another controller.
Right to Object
You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects concerning you.
Exercising Your Rights
To exercise any of these rights, contact us at [email protected]. We will respond to your request within one month, though this period may be extended by two additional months for complex requests.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not complied with GDPR requirements. Visit ico.org.uk for more information.
Data Retention
We retain personal data only as long as necessary for the purposes outlined in our Privacy Policy or as required by law. Typical retention periods include:
- Enquiry data: Three years from last contact
- Project documentation: Seven years after project completion (for professional liability purposes)
- Financial records: Seven years (for tax compliance)
International Data Transfers
We primarily process data within the United Kingdom. Any international data transfers comply with GDPR requirements, including use of standard contractual clauses or adequacy decisions where applicable.
Data Security
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest
- Regular security assessments
- Staff training on data protection
- Access controls limiting who can view personal data
Changes to This Information
We may update this GDPR compliance information periodically. Significant changes will be communicated through our website and, where appropriate, directly to affected individuals.
Contact Us
For questions about GDPR compliance or to exercise your rights, contact us at [email protected].