GDPR Compliance

Last updated: September 8, 2026

1. Our Commitment to GDPR

marblereed is committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR). This page explains how we comply with GDPR requirements and outlines your rights under this regulation.

2. Legal Basis for Processing

We process personal data under the following legal bases:

  • Contract Performance: Processing necessary to fulfill our service obligations
  • Legitimate Interest: Processing necessary for our business operations, provided it does not override your rights
  • Consent: Where you have given explicit consent for specific processing activities
  • Legal Obligation: Processing required to comply with legal requirements

3. Data Controller Information

marblereed acts as the data controller for personal information collected through our website and services.

Contact details:
marblereed
47 Park Street, Clifton
Bristol BS1 5NH
United Kingdom
Email: [email protected]

4. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

4.1 Right to Access

You may request confirmation of whether we process your personal data and access to that data.

4.2 Right to Rectification

You may request correction of inaccurate or incomplete personal data.

4.3 Right to Erasure

You may request deletion of your personal data under certain circumstances, including:

  • Data is no longer necessary for the purposes collected
  • You withdraw consent and no other legal basis exists
  • You object to processing and no overriding legitimate grounds exist
  • Data was unlawfully processed

4.4 Right to Restriction

You may request restriction of processing in specific situations, such as when you contest data accuracy or object to processing.

4.5 Right to Data Portability

You may request transfer of your personal data to another controller in a structured, commonly used format.

4.6 Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

4.7 Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects.

5. How to Exercise Your Rights

To exercise any of your GDPR rights, contact us at [email protected] with:

  • Your full name
  • The specific right you wish to exercise
  • Any relevant details about your request

We will respond to your request within one month. In complex cases, this period may be extended by two months, and you will be informed of any extension.

6. Data Security Measures

We implement appropriate technical and organizational measures to ensure data security, including:

  • Encryption of sensitive data
  • Access controls and authentication
  • Regular security assessments
  • Staff training on data protection
  • Secure data storage and backup procedures

7. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware
  • Notify affected individuals without undue delay if the breach poses a high risk
  • Document all breaches and our response measures

8. International Data Transfers

Personal data is primarily stored and processed within the United Kingdom and European Economic Area. Any transfers outside these regions will comply with GDPR requirements through appropriate safeguards.

9. Data Retention

We retain personal data only as long as necessary for the purposes collected or as required by law. Standard retention periods:

  • Active client records: duration of service plus 7 years
  • Inquiry records: 2 years from last contact
  • Website analytics: 26 months
  • Marketing consent: until consent is withdrawn

10. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information.

11. Right to Lodge a Complaint

If you believe we have not complied with GDPR requirements, you have the right to lodge a complaint with the relevant supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk

12. Updates to This Information

We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.