GDPR Compliance

Last updated: September 2026

Our Commitment to Data Protection

Lavender Spring is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we ensure compliance and protect your rights.

Data Controller

Lavender Spring acts as the data controller for personal data collected through this website. We determine the purposes and means of processing your personal information.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you submit enquiry forms or opt in to communications
• Contract: When processing is necessary to perform our services
• Legitimate Interests: For business operations and service improvement
• Legal Obligation: When required by law

Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your data in certain circumstances
• Right to Restrict Processing: You can request limitation of how we use your data
• Right to Data Portability: You can request your data in a machine-readable format
• Right to Object: You can object to processing based on legitimate interests
• Rights Related to Automated Decision Making: You have rights concerning automated decisions that affect you

Exercising Your Rights

To exercise any of these rights, please contact us using the details below. We will respond to your request within one month. In complex cases, we may extend this period by two months, but we will inform you of any extension and the reasons for it.

Data Protection Officer

While we are not legally required to appoint a Data Protection Officer, we have designated a data protection lead who oversees our compliance efforts and can be contacted at the address below.

Data Transfers

We primarily process data within the United Kingdom. If data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit
• Regular security assessments
• Staff training on data protection
• Access controls and authentication measures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and, where required, notify affected individuals without undue delay.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Contact Us

For data protection enquiries:

Lavender Spring
47 Deansgate, Manchester M3 2BW
[email protected]