GDPR Compliance

Last updated: January 2024

Our Commitment to Data Protection

Qevlaniro Advisory is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we fulfil our obligations under these regulations and how you can exercise your data protection rights.

Data Controller Information

For the purposes of UK GDPR, Qevlaniro Advisory acts as the data controller for the personal information we collect through our website and in the course of providing our services.

Contact details:
Qevlaniro Advisory
47 Whitmore Street
London, EC2A 4BH
United Kingdom
Email: [email protected]

Lawful Bases for Processing

We process personal data under the following lawful bases as defined by UK GDPR Article 6:

Consent (Article 6(1)(a))

Where you have given clear, informed consent for us to process your personal data for a specific purpose. You may withdraw consent at any time by contacting us.

Contractual Necessity (Article 6(1)(b))

Where processing is necessary to perform a contract with you or to take pre-contractual steps at your request, such as responding to enquiries about our services.

Legitimate Interests (Article 6(1)(f))

Where processing is necessary for our legitimate business interests, provided these interests do not override your fundamental rights and freedoms. Our legitimate interests include:

• Improving and developing our services
• Marketing similar services to existing clients
• Ensuring network and information security
• Preventing fraud

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month of receipt. There is no charge for the first copy; additional copies may be subject to a reasonable administrative fee.

Right to Rectification (Article 16)

You have the right to request correction of personal data that is inaccurate or incomplete. We will respond to such requests within one month.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction (Article 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of data or when processing is unlawful but you do not want the data erased.

Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or direct marketing. Where you object to direct marketing, we will stop processing for that purpose.

Rights Related to Automated Decision-Making (Article 22)

We do not currently engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you.

Exercising Your Rights

To exercise any of your data protection rights, please contact us using the details provided above. We may need to verify your identity before processing your request. We will respond to valid requests within one month, though this period may be extended by two months for complex requests, in which case we will inform you of the extension and the reasons for it.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods depend on the type of data and the purposes for which it is processed. When data is no longer required, we securely delete or anonymise it.

International Transfers

Where we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V. These safeguards may include:

• Transfers to countries with adequate levels of protection as determined by the UK government
• Use of standard contractual clauses approved by the Information Commissioner's Office
• Binding corporate rules for transfers within corporate groups

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Complaints

If you are dissatisfied with our handling of your personal data or the way we have responded to a request, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this page periodically.