Last Updated: September 8, 2026
kestrelfern is committed to full compliance with the General Data Protection Regulation and the UK Data Protection Act 2018. This statement outlines how we implement GDPR principles in our operations and service delivery.
For the purposes of data protection legislation, kestrelfern acts as the data controller for personal information collected through our website and business operations.
kestrelfern
42 Park Square East
Leeds LS1 2NE
United Kingdom
Email: dataprotection at kestrelfern.com
We adhere to the following GDPR principles when processing personal data:
We process personal data only when we have a valid legal basis and provide clear information about how data will be used. Our Privacy Policy explains our data practices in accessible language.
Personal data is collected for specified, explicit, and legitimate purposes. We do not process data in ways incompatible with the original purpose for which it was collected without obtaining additional consent.
We collect only the personal data that is adequate, relevant, and necessary for the purposes we have identified. We do not request excessive information.
We take reasonable steps to ensure personal data is accurate and kept up to date. Clients can request corrections to inaccurate information at any time.
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or as required by legal obligations. We maintain documented retention schedules.
We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.
We maintain comprehensive records of our data processing activities and can demonstrate compliance with GDPR principles upon request from supervisory authorities.
Under GDPR, you have the following rights regarding your personal data:
You have the right to clear, transparent information about how we collect and use your personal data. This information is provided through our Privacy Policy and collection notices.
You can request confirmation of whether we are processing your personal data and obtain a copy of that data. We will respond to access requests within one month.
You can request correction of inaccurate or incomplete personal data. We will update records promptly upon verification of corrected information.
Also known as the right to be forgotten, you can request deletion of your personal data in specific circumstances, including when data is no longer necessary for the original purpose or when you withdraw consent.
You can request that we limit how we use your personal data in certain situations, such as when you contest the accuracy of data or object to processing.
You can request that we provide your personal data in a structured, commonly used, and machine-readable format for transmission to another data controller.
You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds.
You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. We do not engage in automated decision making without human oversight.
To exercise any of your GDPR rights, submit a request through one of the following methods:
We may require verification of your identity before processing rights requests to protect against unauthorized disclosure of personal information.
We will respond to requests within one month of receipt. In complex cases, this period may be extended by two additional months. We will inform you of any extension and the reasons for delay.
We maintain records of the following data processing activities:
We integrate data protection considerations into the development of our business processes, systems, and services. This includes:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office within 72 hours of becoming aware of a breach where required by law.
Our breach response procedures include:
When we engage third-party service providers who process personal data on our behalf, we ensure:
When personal data must be transferred outside the United Kingdom, we implement appropriate safeguards including:
We do not knowingly process personal data of individuals under 18 years of age. Our services are directed at adults. If we become aware that we have collected data from a child, we will delete that information immediately.
The Information Commissioner's Office is the supervisory authority responsible for monitoring GDPR compliance in the United Kingdom. You have the right to lodge a complaint with the ICO if you believe our processing of your personal data violates data protection law.
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
We review and update this GDPR Compliance Statement periodically to ensure it remains current with our practices and legal requirements. Material changes will be communicated through our website and, where appropriate, direct notification to affected individuals.
For questions about our GDPR compliance or data protection practices:
Data Protection Officer
kestrelfern
42 Park Square East
Leeds LS1 2NE
United Kingdom
Email: dataprotection at kestrelfern.com