Introduction to GDPR
The General Data Protection Regulation (GDPR) and UK GDPR provide comprehensive data protection rights for individuals. Puianosbren Research Services is committed to full compliance with these regulations and transparent handling of all personal information.
Data Controller Information
Data Controller: Puianosbren Research Services
Address: 47 Thornbury Lane, Bristol, BS8 2PX, United Kingdom
Contact: [email protected]
Lawful Basis for Processing
We process personal data under the following lawful bases:
Contract Performance
Processing your name, email, and service preferences to deliver requested research access and maintain your account.
Legitimate Interests
Analyzing website usage to improve services, ensuring security, and preventing fraud. We balance these interests against your rights and only proceed when our interests do not override your fundamental rights.
Consent
Marketing communications and optional features require your explicit consent, which you can withdraw at any time without affecting other services.
Legal Obligation
Retaining financial records and responding to lawful requests from authorities as required by UK law.
Your GDPR Rights
Right to Access
You can request confirmation of what personal information we hold about you and receive a copy. We will provide this within one month of your request.
Right to Rectification
If information we hold is inaccurate or incomplete, you have the right to have it corrected or completed.
Right to Erasure
You can request deletion of your personal information when:
- The information is no longer necessary for the purpose collected
- You withdraw consent and no other legal basis exists
- You successfully object to processing
- The information was unlawfully processed
- Erasure is required by legal obligation
Right to Restriction of Processing
You can request that we limit how we use your information when:
- You contest the accuracy of the information
- Processing is unlawful but you prefer restriction over erasure
- We no longer need the information but you need it for legal claims
- You have objected to processing pending verification
Right to Data Portability
You can receive personal information you provided in a structured, commonly used, machine-readable format and transmit it to another controller when technically feasible.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects. Should this change, we will notify you and ensure appropriate safeguards.
Exercising Your Rights
To exercise any GDPR right:
- Send a written request to [email protected]
- Clearly state which right you wish to exercise
- Provide information to verify your identity
- Specify any particular information or processing concerned
We will respond within one month. Complex requests may take up to three months, and we will inform you of any extension within the first month.
Data Protection Principles
We adhere to GDPR data protection principles:
Lawfulness, Fairness, and Transparency
We process information lawfully, fairly, and transparently. This policy and our Privacy Policy explain our practices in clear language.
Purpose Limitation
We collect information for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.
Data Minimization
We collect only information adequate, relevant, and necessary for our stated purposes.
Accuracy
We take reasonable steps to ensure information is accurate and up to date. You can request corrections at any time.
Storage Limitation
We retain information only as long as necessary for the purposes collected or as required by law.
Integrity and Confidentiality
We implement appropriate security measures to protect against unauthorized or unlawful processing and accidental loss, destruction, or damage.
Accountability
We maintain documentation demonstrating compliance and regularly review our practices.
Data Security
Technical and organizational measures include:
- Encryption of data in transit and at rest
- Access controls and authentication requirements
- Regular security assessments and updates
- Staff training on data protection
- Incident response procedures
Data Breach Notification
In the event of a data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay. We will inform the ICO within 72 hours of becoming aware of qualifying breaches.
International Transfers
When we transfer personal data outside the UK, we ensure appropriate safeguards such as:
- Adequacy decisions by the UK government
- Standard contractual clauses
- Binding corporate rules
- Codes of conduct or certifications
Third-Party Processors
We only engage processors that provide sufficient guarantees of GDPR compliance. We maintain written contracts specifying:
- Processing scope, duration, nature, and purpose
- Types of personal data and data subject categories
- Controller obligations and processor rights
- Security requirements and breach notification
Children's Data
We do not knowingly process data of individuals under 16 without parental consent. If you believe we have collected such information, contact us immediately for deletion.
Changes to Practices
We will notify you of any changes that affect your rights or how we process your information. Continued use after notification constitutes acceptance unless you exercise your right to object or withdraw consent.
Complaints and Supervisory Authority
If you believe we have violated GDPR, you can:
- Contact us directly at [email protected]
- Lodge a complaint with the Information Commissioner's Office (ICO)
ICO Contact Information:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Questions
For questions about our GDPR compliance or data protection practices, contact [email protected]