Your data protection rights under the UK General Data Protection Regulation
Oak & Hearth Ltd is committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This page provides specific information about your rights under GDPR and how we fulfil our obligations as a data controller.
Oak & Hearth Ltd is the data controller responsible for your personal data. Our contact details are:
Oak & Hearth Ltd
14 Mill Lane, Burford
Oxfordshire, OX18 4SN
United Kingdom
Email: [email protected]
Under the UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. This is commonly known as a subject access request. We will provide this information free of charge within one month of your request.
You have the right to request that we correct any personal data that is inaccurate or incomplete. We will respond to such requests within one month.
You have the right to request that we delete your personal data in certain circumstances, including when the data is no longer necessary for the purpose for which it was collected, or when you withdraw consent on which the processing was based.
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing of it.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from us.
You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis, where we process your data for direct marketing purposes, or where we process your data for research purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not currently use automated decision-making in our processing activities.
To exercise any of your rights under GDPR, please contact us using the details above. We may need to verify your identity before processing your request. We will respond to your request within one month, although this may be extended by a further two months for complex requests.
You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
We process personal data under the following legal bases:
Your personal data is stored and processed within the United Kingdom. We do not routinely transfer personal data outside the UK. Should any transfer outside the UK become necessary, we will ensure appropriate safeguards are in place in accordance with GDPR requirements.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are based on business needs and legal requirements. Customer project records are retained for seven years after project completion to support warranty obligations and regulatory compliance.
We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
If you have concerns about how we handle your personal data, we encourage you to contact us first so we can address your concerns. You also have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
United Kingdom
Website: ico.org.uk
We may update this GDPR information from time to time. Any significant changes will be communicated to you where appropriate.
Last updated: August 2024