GDPR Compliance Statement

Our Commitment to GDPR

flicker-construct. is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a provider of payment processing systems for social benefits, we recognise the critical importance of protecting personal data.

Data Controller Information

For the purposes of UK GDPR, flicker-construct. acts as a data controller when processing personal information collected through our website and business operations.

Data Controller: flicker-construct.
Registered Address: 128 Westbourne Terrace, Paddington, London W2 6QE, United Kingdom
Contact Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes
• Contract: Where processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
• Legal Obligation: Where processing is necessary for compliance with a legal obligation
• Legitimate Interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, provided your interests and fundamental rights do not override those interests

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Be Informed

You have the right to clear, transparent information about how we use your personal data. This is provided through our Privacy Policy and this GDPR compliance statement.

Right of Access

You have the right to request access to your personal data. This is known as a Subject Access Request (SAR). We will provide you with a copy of your personal data within one month of your request.

Right to Rectification

You have the right to have inaccurate personal data corrected or completed if it is incomplete.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including where:

• The personal data is no longer necessary for the purpose it was originally collected
• You withdraw consent and there is no other legal basis for processing
• You object to the processing and there are no overriding legitimate grounds
• The personal data was unlawfully processed

Right to Restrict Processing

You have the right to request restriction of processing of your personal data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or the performance of a task in the public interest.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]

We will respond to your request within one month. In complex cases, this may be extended by up to two months, and we will inform you of any such extension.

Data Protection Measures

We implement appropriate technical and organisational measures to ensure data security:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication measures
• Regular staff training on data protection
• Incident response and breach notification procedures
• Data minimisation practices
• Regular backup and disaster recovery testing

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where required by law.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Specific retention periods vary depending on the type of data and purpose:

• Enquiry data: Retained for 2 years from last contact
• Client contract data: Retained for 7 years after contract termination
• Payment records: Retained for 7 years in accordance with tax regulations
• Marketing consent: Retained until consent is withdrawn

Third-Party Processors

Where we engage third-party processors to handle personal data on our behalf, we ensure:

• Written contracts are in place outlining data protection obligations
• Processors provide sufficient guarantees of appropriate technical and organisational measures
• Processors only act on our documented instructions
• Regular audits and assessments of processor compliance

International Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by the ICO
• Binding corporate rules

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing operations that are likely to result in high risk to individuals' rights and freedoms.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.flicker-construct.com

Changes to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised date.

Contact Us

For any questions about our GDPR compliance or to exercise your data protection rights, please contact:

Email: [email protected]
Address: 128 Westbourne Terrace, Paddington, London W2 6QE, United Kingdom