GDPR Compliance

Last Updated: May 15, 2026

Our Commitment to Data Protection

dusk-stone is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these regulations and what this means for you.

Data Controller

For the purposes of UK GDPR, dusk-stone is the data controller responsible for your personal information. We determine how and why your personal data is processed.

Contact details:
Email: [email protected]
Address: 147 Holborn House, Bloomsbury Way, London WC1A 2TH, United Kingdom

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so. The lawful bases we rely on include:

Contract Performance

Processing is necessary to perform our contractual obligations when you engage our services.

Legitimate Interests

Processing is necessary for our legitimate business interests, such as:

• Improving our services and website
• Communicating with you about relevant updates
• Maintaining records for business purposes
• Protecting against fraud and security threats

Legal Obligation

Processing is necessary to comply with legal requirements, such as tax laws and professional regulations.

Consent

Where we rely on your consent, you have the right to withdraw it at any time by contacting us.

Your GDPR Rights

Under UK GDPR, you have comprehensive rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to Rectification

If information we hold about you is inaccurate or incomplete, you can request that we correct or complete it.

Right to Erasure

In certain circumstances, you can request that we delete your personal data. This right is not absolute and may not apply if we have legal obligations to retain the information.

Right to Restriction of Processing

You can request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data.

Right to Data Portability

Where technically feasible, you can request that we transfer your data to another service provider in a structured, commonly used format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds to continue.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling in ways that produce legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with the following information:

• Your full name and contact details
• A clear description of which right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within one month. If your request is complex, we may extend this period by up to two additional months and will inform you of the extension.

Data Security Measures

We implement appropriate technical and organisational security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls ensuring only authorised personnel can access personal data
• Staff training on data protection and security practices
• Incident response procedures for data breaches

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware of the breach
• Inform you directly if the breach is likely to result in high risk to you
• Provide details about the nature of the breach and the measures we are taking

International Data Transfers

We primarily process data within the United Kingdom. If we need to transfer your data outside the UK, we will ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the ICO
• Transfers to countries with adequacy decisions
• Other legally approved transfer mechanisms

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Active client data: retained while providing services and for a reasonable period afterwards
• Financial records: retained for at least six years to comply with tax regulations
• Marketing communications: retained until you unsubscribe or withdraw consent

Third-Party Processors

When we engage third-party service providers to process data on our behalf, we:

• Ensure they provide sufficient guarantees of GDPR compliance
• Establish written contracts governing their processing activities
• Monitor their compliance with data protection obligations

Children's Data

We do not knowingly collect or process personal data from individuals under 18 years of age. If we become aware that we have collected such data, we will delete it promptly.

Updates to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website or by email.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not complied with data protection laws.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Contact Us

If you have questions about our GDPR compliance or wish to exercise your rights, please contact us at [email protected].