GDPR Compliance Statement

Last updated: 8 September 2026

Our Commitment to Data Protection

vesperdrift is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We respect your privacy and take our data protection responsibilities seriously. This statement outlines how we ensure compliance with data protection principles in our environmental consulting operations.

Data Protection Principles

We adhere to the following data protection principles when processing personal information:

• Lawfulness, fairness, and transparency: We process personal data lawfully and transparently, providing clear information about how we use your data
• Purpose limitation: We collect personal data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes
• Data minimisation: We collect only the personal data that is adequate, relevant, and necessary for our purposes
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date
• Storage limitation: We retain personal data only as long as necessary for the purposes for which it was collected
• Integrity and confidentiality: We implement appropriate security measures to protect personal data against unauthorised or unlawful processing and accidental loss, destruction, or damage
• Accountability: We are responsible for demonstrating compliance with these principles

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by UK GDPR:

• Contract: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract
• Legal obligation: Processing is necessary to comply with legal obligations to which we are subject
• Legitimate interests: Processing is necessary for purposes of our legitimate business interests, except where such interests are overridden by your data protection rights
• Consent: You have given explicit consent for processing of your personal data for specific purposes

Your Data Protection Rights

Under UK GDPR, you have the following rights:

Right to be Informed

You have the right to clear, transparent information about how we use your personal data. This information is provided in our Privacy Policy and this GDPR Compliance Statement.

Right of Access

You have the right to obtain confirmation that we are processing your personal data and to access that data. This is commonly known as a subject access request. We will provide a copy of your personal data free of charge within one month of your request.

Right to Rectification

You have the right to have inaccurate personal data corrected and incomplete personal data completed. We will respond to rectification requests within one month.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including:

• The personal data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The personal data has been unlawfully processed

This right is not absolute and may be subject to legal or professional retention requirements.

Right to Restrict Processing

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of personal data or object to processing based on legitimate interests.

Right to Data Portability

You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects. Should this change, we will notify you and provide appropriate safeguards.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at:

Email: [email protected]
Address: 47 Deansgate, Manchester, M3 2AY, United Kingdom

We will respond to requests within one month, as required by UK GDPR. In complex cases, this period may be extended by up to two months, in which case we will inform you of the extension and the reasons for the delay.

Data Security Measures

We implement technical and organisational measures to ensure appropriate security of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction, or damage. Our security measures include:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Staff training on data protection and security practices
• Incident response procedures for data breaches
• Secure disposal procedures for personal data no longer required

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

Third-Party Processors

When we engage third-party service providers to process personal data on our behalf, we ensure that:

• Appropriate data processing agreements are in place
• Processors provide sufficient guarantees regarding security measures
• Processors process personal data only on our documented instructions
• Processors comply with UK GDPR requirements

International Transfers

We primarily process personal data within the United Kingdom. Should we transfer personal data outside the UK, we will ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other approved mechanisms under UK GDPR.

Data Protection Contact

For questions about our GDPR compliance or data protection practices, please contact us at:

Email: [email protected]
Address: 47 Deansgate, Manchester, M3 2AY, United Kingdom

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office if you believe we have not complied with UK GDPR requirements:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Policy Updates

We review and update our GDPR compliance practices regularly to ensure ongoing adherence to data protection requirements. This statement may be updated to reflect changes in our practices or legal obligations. The current version will always be available on our website with the revision date clearly indicated.