GDPR Compliance

Last updated: November 2024

Our Commitment to GDPR

Peak-fjord Ltd is committed to complying with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We take our data protection responsibilities seriously and have implemented measures to ensure your personal data is handled lawfully, fairly, and transparently.

Data Controller

Peak-fjord Ltd acts as the data controller for personal information collected through our website and services. This means we determine the purposes and means of processing your personal data.

Data Controller: Peak-fjord Ltd
Address: 47 Hillside Road, Keswick, Cumbria CA12 4DQ, United Kingdom
Email: [email protected]

Lawful Bases for Processing

We process personal data under the following lawful bases as defined by GDPR:

Contract Performance (Article 6(1)(b))

We process your data when necessary to perform a contract with you, such as:

• Managing your booking and reservation
• Providing you with hiking tour services
• Communicating about your booking

Legitimate Interests (Article 6(1)(f))

We may process data based on our legitimate business interests, including:

• Improving our services and customer experience
• Analysing website usage to enhance functionality
• Preventing fraud and ensuring security

Consent (Article 6(1)(a))

Where required, we obtain your consent for processing, such as:

• Marketing communications and newsletters
• Non-essential cookies

Legal Obligation (Article 6(1)(c))

We process data where necessary to comply with legal requirements, including tax and accounting obligations.

Your Rights Under GDPR

GDPR provides you with specific rights regarding your personal data:

Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will provide this within one month of receiving your request.

Right to Rectification (Article 16)

You have the right to request that we correct any inaccurate personal data or complete any incomplete data we hold about you.

Right to Erasure (Article 17)

Also known as the "right to be forgotten", you may request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.

Right to Restriction of Processing (Article 18)

You have the right to request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of your data.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, this period may be extended by a further two months, and we will inform you of any such extension.

We may need to verify your identity before processing your request. We will not charge a fee for most requests, but may charge a reasonable fee if your request is clearly unfounded or excessive.

Data Security Measures

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Secure data storage with access controls
• Encryption of data in transit
• Regular security assessments
• Staff training on data protection
• Incident response procedures

Data Breach Procedures

In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware of the breach
• Communicate with affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Document all breaches, including the facts, effects, and remedial actions taken

International Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are determined by:

• The nature of the data and why it was collected
• Legal, regulatory, and contractual requirements
• Legitimate business purposes

Complaints

If you are not satisfied with how we handle your personal data or your exercise of rights, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Contact

For any questions about this GDPR statement or our data protection practices, please contact:

Peak-fjord Ltd
47 Hillside Road
Keswick, Cumbria CA12 4DQ
United Kingdom

Email: [email protected]