GDPR Compliance

Last updated: August 14, 2026

Our Commitment to GDPR

glossy-bamboo is committed to complying with the General Data Protection Regulation and protecting the rights of individuals whose personal data we process. This page outlines how we meet our obligations under GDPR and how you can exercise your rights.

Data Controller Information

For the purposes of GDPR, the data controller is:

glossy-bamboo
42 Castle Street
Liverpool, L2 7LQ
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. Our lawful bases include:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary to fulfill a contract with you or take steps at your request before entering into a contract
• Legal obligation: Processing is necessary to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, provided your rights do not override these interests

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to be Informed

You have the right to clear, transparent information about how we use your personal data. This information is provided in our Privacy Policy and this GDPR page.

Right of Access

You have the right to request copies of your personal data. We may charge a reasonable fee for additional copies of the same information.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or if you withdraw consent.

Right to Restrict Processing

You have the right to request restriction of processing your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to request transfer of your personal data to another organization or directly to you in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling in our processing of personal data.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the following information:

• Your full name and contact information
• Description of your request and the right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two months and will notify you accordingly.

Data Protection Principles

We ensure that personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept only for as long as necessary
• Processed in a secure manner

International Data Transfers

We primarily process data within the United Kingdom and European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

Children's Data

We do not knowingly process personal data of children under 16 years of age without parental consent.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. In the UK, the relevant authority is:

Information Commissioner's Office (ICO)
Website: ico.org.uk

Updates to This Page

We may update this GDPR compliance information from time to time. Please check this page periodically for changes.