GDPR Compliance

Last Updated: July 21, 2026

Our Commitment to GDPR

ochre-thicket is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable UK data protection laws. This page outlines how we comply with GDPR principles and your rights as a data subject.

Data Controller Information

For the purposes of GDPR, the data controller is:

ochre-thicket
47 Kensington Gardens Square
London W2 4BG
United Kingdom
Email: dpo@ochre-thicket.com

Principles of Data Processing

We process personal data in accordance with the following GDPR principles:

• Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes
• Data minimization: We collect only data that is adequate, relevant, and limited to what is necessary
• Accuracy: We take steps to ensure personal data is accurate and kept up to date
• Storage limitation: We retain data only for as long as necessary
• Integrity and confidentiality: We implement appropriate security measures to protect data

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you provide explicit consent through form submissions or cookie acceptance
• Contract: To fulfill consultation requests and provide services you have requested
• Legitimate interests: To improve our services and website functionality, where such interests do not override your rights
• Legal obligation: To comply with applicable laws and regulations

Your Rights Under GDPR

Right to Access

You have the right to request confirmation of whether we are processing your personal data and to receive a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected or if you withdraw your consent.

Right to Restrict Processing

You can request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. In the UK, the relevant authority is the Information Commissioner's Office (ICO).

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us:

• Email: dpo@ochre-thicket.com
• Written request to: 47 Kensington Gardens Square, London W2 4BG, United Kingdom

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months, and we will inform you of such extension.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Staff training on data protection principles
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR requirements.

International Data Transfers

If we transfer your personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission or adequacy decisions.

Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you.

Updates to This Statement

We may update this GDPR compliance statement periodically. Significant changes will be communicated through our website or by email.

Contact Information

For any questions regarding GDPR compliance or data protection matters:

Data Protection Officer
Email: dpo@ochre-thicket.com
Address: 47 Kensington Gardens Square, London W2 4BG, United Kingdom