GDPR Compliance

Last Updated: June 2024

Our Commitment to Data Protection

Quiet Roam is committed to protecting your personal data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document outlines how we fulfill our obligations and respect your rights under these regulations.

Data Controller Information

For the purposes of UK GDPR, the data controller is:

quiet-roam.com
42 Queen Square
Bristol BS1 4QP
United Kingdom

Email: gdpr @ quiet-roam.com

Legal Basis for Processing

We process personal data under the following legal bases as defined by UK GDPR:

Consent

When you provide explicit consent for us to process your personal data for specific purposes, such as receiving consultation services or communications. You may withdraw consent at any time.

Contractual Necessity

Processing necessary to fulfill our service agreements with you, including property search services, consultation arrangements, and related obligations.

Legitimate Interests

Processing necessary for our legitimate business interests, such as improving services, maintaining security, and preventing fraud, provided these interests do not override your fundamental rights and freedoms.

Legal Obligation

Processing required to comply with legal obligations, including financial record-keeping, tax compliance, and responses to lawful requests from authorities.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Be Informed

You have the right to clear, transparent information about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR compliance document.

Right of Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information within one month of your request.

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected or completed. We will action rectification requests within one month.

Right to Erasure

Also known as the "right to be forgotten," you may request deletion of your personal data in certain circumstances:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

We will comply with erasure requests unless legal obligations require us to retain certain information, such as financial records.

Right to Restrict Processing

You may request that we limit how we use your personal data in the following situations:

• You contest the accuracy of the data while we verify it
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller. This applies to data you provided to us with consent or under contract, and where processing is automated.

Right to Object

You may object to processing of your personal data when:

• Processing is based on legitimate interests or performance of a public interest task
• Data is used for direct marketing purposes
• Processing is for scientific, historical research, or statistical purposes

We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing relates to legal claims.

Rights Related to Automated Decision Making and Profiling

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not engage in automated decision-making or profiling activities.

How to Exercise Your Rights

To exercise any of your rights under UK GDPR, please submit a written request to:

GDPR Requests
quiet-roam.com
42 Queen Square
Bristol BS1 4QP
United Kingdom

Email: gdpr @ quiet-roam.com

When submitting a request, please include:

• Your full name and contact information
• Specific right you wish to exercise
• Any relevant details that will help us locate your information
• Proof of identity to prevent unauthorized disclosure

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any extension within the initial month.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security and protection:

Technical Measures

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security testing and vulnerability assessments
• Secure backup systems with encryption
• Firewall protection and intrusion detection systems

Organizational Measures

• Staff training on data protection principles and obligations
• Confidentiality agreements with all personnel
• Regular review and update of data protection policies
• Incident response procedures for data breaches
• Privacy by design principles in all business processes

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR.

Notification will include:

• Nature of the breach and categories of data affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for further inquiries

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions confirming recipient country provides adequate protection
• Standard contractual clauses approved by regulatory authorities
• Binding corporate rules for intra-group transfers

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active client records: Duration of engagement plus six years
• Inquiry records from non-clients: Two years from last contact
• Financial and accounting records: Seven years per UK tax law
• Website analytics data: One year
• Cookie data: As specified in our Cookies Policy

Children's Data

We do not knowingly collect or process personal data from individuals under 18 years of age. Our services are directed solely to adults. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

Complaints and Supervisory Authority

If you believe your data protection rights have been violated or you are dissatisfied with our response to your concerns, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Telephone: 0303 123 1113
Website: ico.org.uk

We encourage you to contact us first so we may address your concerns directly before escalating to the supervisory authority.

Updates to This Document

We review and update this GDPR compliance document regularly to reflect changes in our practices, legal requirements, or regulatory guidance. The date of the most recent update appears at the top of this document.

Significant changes will be communicated to active clients via email. Continued use of our services following updates constitutes acceptance of the revised terms.

Contact for Data Protection Matters

For questions, concerns, or requests related to data protection and UK GDPR compliance:

Email: gdpr @ quiet-roam.com
Address: 42 Queen Square, Bristol BS1 4QP, United Kingdom