GDPR Compliance

Last updated: June 26, 2026

valley-marmot is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and explains your rights under this regulation.

Data Controller

valley-marmot acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing your personal data.

Contact: [email protected]

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you voluntarily submit information through our contact forms
• Contractual Necessity: When processing is necessary to provide services you've requested
• Legitimate Interests: For business operations, service improvement, and communication about relevant services
• Legal Obligation: When required to comply with applicable laws

Your Rights Under GDPR

Under the GDPR, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request transfer of your data to another service
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw previously given consent at any time

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month of receiving your request.

You will need to verify your identity before we can fulfill certain requests. We may ask for additional information to confirm your identity and ensure we're protecting your data.

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including:

• While you're an active client or prospect
• To comply with legal, accounting, or reporting requirements
• To establish, exercise, or defend legal claims

When personal data is no longer needed, we will securely delete or anonymize it.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection principles

International Data Transfers

Your personal data is processed and stored within the United Kingdom and European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Supervisory Authority

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not complied with GDPR requirements.

ICO Contact: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Changes to This Notice

We may update this GDPR compliance notice to reflect changes in our practices or applicable law. We will post any updates on this page with a revised effective date.

Questions and Concerns

If you have questions about our GDPR compliance or wish to exercise your rights, please contact us at [email protected].