GDPR Compliance Statement

Last updated: June 18, 2026

cerulean-seed is committed to protecting your personal data and respecting your privacy rights under the UK General Data Protection Regulation. This statement outlines how we comply with data protection principles and your rights as a data subject.

Our Commitment to Data Protection

We adhere to the following data protection principles in all our processing activities:

• Lawfulness, fairness, and transparency in data processing
• Purpose limitation - collecting data only for specified, legitimate purposes
• Data minimization - collecting only what is necessary
• Accuracy - keeping personal data accurate and up to date
• Storage limitation - retaining data only as long as necessary
• Integrity and confidentiality - ensuring appropriate security measures
• Accountability - demonstrating compliance with these principles

Data Controller Information

cerulean-seed acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing your personal data.

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain access to that data. We will provide a copy of your personal data in a commonly used electronic format upon request.

Right to Rectification

You can request correction of inaccurate personal data and completion of incomplete personal data. We will respond to rectification requests within one month.

Right to Erasure

You may request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent on which processing is based
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

This right may be limited by legal obligations requiring us to retain certain information.

Right to Restriction of Processing

You can request that we restrict processing of your personal data when:

• You contest the accuracy of the data during verification
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you need it for legal claims
• You object to processing pending verification of legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with data protection law, you have the right to lodge a complaint with the Information Commissioner's Office:

How to Exercise Your Rights

To exercise any of your rights, please contact us using the details provided below. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

When submitting a request, please provide:

• Your full name and contact information
• Description of the right you wish to exercise
• Any relevant details to help us locate your information
• Proof of identity if requested for security purposes

Data Processing Activities

Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: name, contact information
• Technical data: IP address, browser type, device information
• Usage data: website interaction and navigation patterns
• Communication data: inquiry content and correspondence
• Service data: property type, service preferences, appointment details

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Contract performance: to provide services you have requested
• Legitimate interests: to operate and improve our business
• Consent: where you have explicitly agreed to processing
• Legal obligation: to comply with applicable laws and regulations

Data Sharing

We do not sell personal data. We share data only with:

• Service providers who assist in our operations, under strict confidentiality agreements
• Professional advisors when necessary for business operations
• Law enforcement or regulatory bodies when legally required

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and vulnerability testing
• Staff training on data protection and security practices
• Incident response procedures for data breaches

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. We will also notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.

International Data Transfers

Your personal data is processed and stored within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the UK government
• Standard contractual clauses
• Binding corporate rules
• Other legally recognized transfer mechanisms

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Our retention periods are:

• Inquiry data: 24 months from last contact
• Client service records: duration of service relationship plus 7 years
• Website analytics: 26 months
• Marketing communications: until consent is withdrawn

Changes to This Statement

We may update this GDPR Compliance Statement periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.

Contact Information

For questions about GDPR compliance or to exercise your data protection rights, please contact us: