GDPR Compliance

Last updated: 4 August 2026

Our Commitment to Data Protection

sage-stoat is committed to compliance with the UK General Data Protection Regulation and the Data Protection Act 2018. This page outlines how we fulfil our obligations as a data controller when processing personal information.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

sage-stoat
47 Colmore Row
Birmingham
B3 2BS
United Kingdom

Email: [email protected]

Lawful Basis for Processing

We process personal data only where we have a lawful basis to do so. The specific basis depends on the purpose of processing:

• Contract performance: Processing necessary to provide consultancy services you have engaged us for
• Legitimate interests: Processing necessary for our business operations, provided your rights are not overridden
• Legal obligation: Processing required to comply with laws, regulations, and professional standards
• Consent: Where you have given clear permission for specific processing activities

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data. We will respond to access requests within one month.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update our records promptly upon verification.

Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purpose collected or if you withdraw consent. This right is subject to legal and regulatory retention requirements.

Right to Restriction

You can request that we limit how we use your data in specific situations, such as while we verify accuracy or assess a deletion request.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds.

Right to Data Portability

You can request that we transfer your data to another service provider in a structured, commonly used format where technically feasible.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing conducted before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us by email at [email protected] or by post at the address above. We may need to verify your identity before processing your request.

Data Processing Principles

We adhere to the following data protection principles:

• Processing personal data lawfully, fairly, and transparently
• Collecting data only for specified, explicit, and legitimate purposes
• Ensuring data is adequate, relevant, and limited to what is necessary
• Maintaining accuracy and keeping data up to date
• Retaining data only for as long as necessary
• Processing data securely with appropriate safeguards

Data Security Measures

We implement technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encrypted transmission of data over the internet
• Secure storage systems with access controls
• Regular security assessments and updates
• Staff training on data protection responsibilities
• Confidentiality agreements with third-party processors

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by law.

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom. If international transfer becomes necessary, we will ensure appropriate safeguards are in place as required by data protection legislation.

Automated Decision Making

We do not use automated decision making or profiling in our consultancy services. All assessments and recommendations are made by qualified human consultants.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk

Policy Updates

We review this GDPR compliance statement regularly and will notify you of material changes through our website or by email where appropriate.