Our Commitment to Data Protection
Stepbpoppa is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our responsibilities as a data controller seriously and have implemented comprehensive measures to protect your personal information.
Data Controller Information
Stepbpoppa acts as the data controller for personal information collected through our website and services. As the data controller, we determine the purposes and means of processing your personal data.
Our contact details are:
Stepbpoppa
47 Merchant Street
London, EC2R 8AH
United Kingdom
Email: [email protected]
Your Rights Under UK GDPR
The UK GDPR provides you with specific rights regarding your personal data. We are committed to facilitating the exercise of these rights.
Right to Be Informed
You have the right to receive clear, transparent information about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR notice.
Right of Access
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.
Right to Rectification
You have the right to request that we correct any inaccurate personal data we hold about you. If your data is incomplete, you can request that we complete it.
Right to Erasure
Also known as the "right to be forgotten", you can request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
Right to Restrict Processing
You have the right to request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of your data or object to our processing.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to have it transferred to another data controller where technically feasible.
Right to Object
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
Rights Related to Automated Decision Making
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.
Exercising Your Rights
To exercise any of your rights under UK GDPR, please contact us at [email protected]. We may need to verify your identity before processing your request.
We will respond to your request within one month. In complex cases or where we receive numerous requests, we may extend this period by up to two months, but we will inform you of any extension and the reasons for it.
Lawful Basis for Processing
We only process personal data when we have a valid lawful basis to do so. The lawful bases we rely on include:
- Contractual Necessity: Processing required to perform our agreement with you
- Legal Obligation: Processing required to comply with UK law
- Legitimate Interests: Processing for our legitimate business purposes, where these do not override your rights
- Consent: Where you have provided specific, informed consent
Data Protection Measures
We have implemented appropriate technical and organisational measures to ensure the security of your personal data, including:
- Encryption of personal data during transmission and storage
- Regular testing and evaluation of security measures
- Staff training on data protection obligations
- Access controls limiting data access to authorised personnel
- Incident response procedures for potential data breaches
International Data Transfers
Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place as required by UK GDPR. These may include:
- Transfers to countries with adequacy decisions
- Standard contractual clauses approved by the ICO
- Binding corporate rules where applicable
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.
Complaints
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Notice
We may update this GDPR notice from time to time. Any changes will be posted on this page with an updated revision date.