GDPR Compliance

Last Updated: January 2024

Sky-jay is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines our data protection practices and your rights as a data subject.

1. Data Controller Information

Sky-jay is the data controller responsible for your personal data. Our contact details are:

Sky-jay
42 Finsbury Square
London, EC2A 1PX
United Kingdom
Email: [email protected]

2. Data Protection Principles

We adhere to the following principles when processing personal data:

• Lawfulness, fairness, and transparency: We process data lawfully and openly
• Purpose limitation: Data is collected for specified, explicit purposes only
• Data minimisation: We collect only what is necessary
• Accuracy: We keep personal data accurate and up to date
• Storage limitation: Data is retained only as long as necessary
• Integrity and confidentiality: We implement appropriate security measures
• Accountability: We take responsibility for compliance

3. Legal Bases for Processing

We process personal data under the following legal bases:

Contractual Necessity

Processing necessary to perform our services or take pre-contractual steps at your request.

Legitimate Interests

Processing necessary for our legitimate business interests, balanced against your rights. This includes:

• Improving our services and website
• Marketing our services to existing customers
• Preventing fraud and maintaining security

Legal Obligations

Processing required to comply with applicable laws and regulations.

Consent

Where you have given explicit consent for specific processing activities, such as marketing communications.

4. Your Rights Under UK GDPR

As a data subject, you have the following rights:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this within one month of receiving your request.

Right to Rectification

You can request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including when:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds

Right to Restrict Processing

You can request that we limit how we use your data in certain situations.

Right to Data Portability

You can request your personal data in a structured, machine-readable format to transfer to another service provider.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

You have rights concerning automated decisions that significantly affect you, including profiling.

5. How to Exercise Your Rights

To exercise any of your rights, please contact us at:

Email: [email protected]

We will respond to your request within one month. In complex cases, this period may be extended by two additional months, and we will inform you if this is necessary.

We may request verification of your identity before processing your request to ensure data security.

6. Data Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Access controls and authentication systems
• Regular security assessments and penetration testing
• Staff training on data protection
• Incident response procedures

7. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours
• Inform affected individuals without undue delay when required
• Document all breaches, including their effects and remedial actions

8. International Data Transfers

When we transfer personal data outside the UK, we ensure appropriate safeguards are in place:

• Adequacy decisions by the UK Government
• Standard Contractual Clauses approved by the ICO
• Binding Corporate Rules for intra-group transfers

9. Data Retention

We retain personal data according to the following principles:

• Customer data: Duration of the service relationship plus 6 years
• Enquiry data: 2 years from last contact
• Marketing data: Until consent is withdrawn
• Legal compliance data: As required by applicable laws

10. Third-Party Processors

We use third-party service providers to assist in our operations. All processors are bound by data processing agreements that ensure:

• Processing only on our documented instructions
• Confidentiality obligations for staff
• Appropriate security measures
• Sub-processor controls
• Assistance with data subject rights

11. Complaints

If you are unsatisfied with how we handle your personal data, you can:

1. Contact us directly to resolve the issue
2. Lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

12. Updates to This Notice

We may update this GDPR compliance notice periodically. Changes will be posted on this page with a revised date. We encourage you to review this notice regularly.