GDPR Compliance

Last updated: September 30, 2026

Our Commitment to GDPR

Glacier-cypress is committed to compliance with the General Data Protection Regulation (GDPR) and UK data protection laws. We process personal data lawfully, fairly, and transparently.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you submit forms or agree to communications
• Contractual necessity: To provide services you have requested
• Legitimate interests: To improve our services and communicate relevant information
• Legal obligations: To comply with applicable laws and regulations

Data Processing Principles

We adhere to the following principles when processing personal data:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

Your GDPR Rights

Under GDPR, you have the following rights:

• Right to be informed: About how we collect and use your data
• Right of access: To request copies of your personal data
• Right to rectification: To request correction of inaccurate data
• Right to erasure: To request deletion of your data
• Right to restrict processing: To request limitation of how we use your data
• Right to data portability: To receive your data in a structured format
• Right to object: To object to certain types of processing
• Rights related to automated decision-making: We do not use automated decision-making or profiling

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. When data is no longer needed, we securely delete or anonymize it.

Data Transfers

We do not transfer personal data outside the United Kingdom or European Economic Area. If such transfers become necessary, we will ensure appropriate safeguards are in place.

Data Breach Procedures

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at: [email protected]

We will respond to your request within one month. In complex cases, this may be extended by a further two months, and we will inform you of any such extension.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom.