Last Updated: September 1, 2026
Our Commitment to GDPR
khaki-storm is committed to complying with the General Data Protection Regulation (GDPR) and protecting the personal data of individuals within the European Economic Area and the United Kingdom. This document outlines our practices and your rights under GDPR.
Data Controller Information
khaki-storm
42 Portland Gardens
Bristol BS8 4LH
United Kingdom
Email: [email protected]
Your Rights Under GDPR
Right to Access
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format upon request.
Right to Rectification
You may request correction of inaccurate or incomplete personal data. We will make reasonable efforts to update our records promptly upon receiving verified correction requests.
Right to Erasure
Also known as the "right to be forgotten," you may request deletion of your personal data when:
- The data is no longer necessary for the purposes for which it was collected
- You withdraw consent and there is no other legal basis for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
- Deletion is required for compliance with legal obligations
Right to Restriction of Processing
You may request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing activities.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.
Right to Object
You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
Right to Lodge a Complaint
If you believe our processing of your personal data violates GDPR, you have the right to lodge a complaint with the appropriate supervisory authority in your jurisdiction.
Legal Basis for Processing
We process personal data only when we have a valid legal basis:
- Consent: You have provided explicit consent for specific processing activities
- Contract Performance: Processing is necessary to fulfill our contractual obligations
- Legal Obligations: Processing is required to comply with applicable laws
- Legitimate Interests: Processing serves our legitimate business interests while respecting your fundamental rights and freedoms
Data Protection Principles
We adhere to the following data protection principles:
- Lawfulness, Fairness, and Transparency: We process data lawfully and inform individuals about processing activities
- Purpose Limitation: We collect data for specified, explicit, and legitimate purposes only
- Data Minimization: We collect only data that is adequate, relevant, and necessary
- Accuracy: We maintain accurate data and correct inaccuracies promptly
- Storage Limitation: We retain data only as long as necessary for its intended purpose
- Integrity and Confidentiality: We implement appropriate security measures to protect data
- Accountability: We demonstrate compliance with data protection principles
Data Security Measures
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data in transit and at rest
- Regular security assessments and vulnerability testing
- Access controls and authentication mechanisms
- Employee training on data protection practices
- Incident response and breach notification procedures
- Data backup and recovery systems
Data Breach Notification
In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the appropriate supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.
International Data Transfers
We primarily process and store personal data within the United Kingdom and European Economic Area. Any transfers to third countries will be conducted in accordance with GDPR requirements, utilizing appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
Automated Decision-Making and Profiling
We do not engage in automated decision-making or profiling activities that produce legal or similarly significant effects on individuals.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable legal, accounting, or reporting requirements. Our retention periods are based on:
- The nature and sensitivity of the data
- The purposes for which we process the data
- Legal, regulatory, or contractual obligations
- Legitimate business needs
Third-Party Processors
When we engage third-party service providers to process personal data on our behalf, we ensure they provide sufficient guarantees regarding technical and organizational security measures. We maintain written agreements with all processors that specify their data protection obligations.
Exercising Your Rights
To exercise any of your rights under GDPR, please contact us:
Email: [email protected]
We will respond to your request without undue delay and within one month of receipt. In complex cases, we may extend this period by an additional two months, and we will inform you of any such extension.
Updates to This Statement
We may update this GDPR compliance statement periodically to reflect changes in our practices or applicable regulations. We will notify you of any material changes through our website.