GDPR Compliance

General Data Protection Regulation

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on 25 May 2018. It governs how organisations collect, use, and protect personal data of individuals within the United Kingdom and European Union.

Our Commitment

wanderspan is committed to compliance with UK GDPR and the Data Protection Act 2018. We respect your privacy rights and handle your personal data with care and transparency.

Data Controller

wanderspan acts as the data controller for personal information collected through this website and in the course of providing our services. This means we determine how and why your data is processed.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access

You can request a copy of the personal data we hold about you. We will respond to your request within one month.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or completion.

Right to Erasure

In certain circumstances, you can request that we delete your personal data. This applies when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.

Right to Restrict Processing

You can ask us to limit how we use your personal data in certain situations, such as when you contest the accuracy of the data.

Right to Data Portability

Where processing is based on consent or contract, you can request your data in a structured, commonly used format for transfer to another organisation.

Right to Object

You have the right to object to processing based on legitimate interests, including direct marketing.

Rights Related to Automated Decision-Making

You have rights concerning automated decisions that significantly affect you. We do not currently use automated decision-making processes.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you explicitly agree to processing for specific purposes
• Contract: When processing is necessary to fulfil a service agreement
• Legitimate Interests: When processing supports our business operations without overriding your rights
• Legal Obligation: When required by law

Data Protection Measures

We implement appropriate technical and organisational measures to ensure data security, including:

• Secure storage of physical and electronic records
• Access controls limiting data access to authorised personnel
• Regular review of data handling procedures
• Staff awareness of data protection responsibilities

International Transfers

We do not routinely transfer personal data outside the United Kingdom. If any transfer becomes necessary, we will ensure appropriate safeguards are in place.

Data Breach Procedures

In the event of a personal data breach that poses a risk to individuals, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay when required.

Exercising Your Rights

To exercise any of your rights, please contact us at: [email protected]

We may request identification to verify your identity before fulfilling your request. There is no charge for most requests, though we may apply a reasonable fee for manifestly unfounded or excessive requests.

Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.