neo-savanna

Our Commitment to Data Protection

neo-savanna is committed to protecting your personal data and respecting your privacy rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with data protection regulations and what rights you have regarding your personal information.

Data Controller Information

For the purposes of UK data protection law, the data controller is:

neo-savanna
17 Charlotte Square
Edinburgh, EH2 4DF
United Kingdom
Email: [email protected]

Types of Personal Data We Process

Identity Data

Includes your full name and other identifiers you provide when requesting our services.

Contact Data

Includes email address and postal address when provided.

Service Data

Includes information about the services you have requested, consultation records, and related communications.

Technical Data

Includes IP address, browser type, device information, and usage data collected when you visit our website.

Marketing and Communications Data

Includes your preferences regarding receiving information about our services.

Lawful Basis for Processing

We only process your personal data when we have a lawful basis to do so:

Performance of Contract

When you request our financial education services, we need to process your data to fulfill that service agreement.

Legitimate Interests

We have legitimate business interests in:

Improving our website and services
Ensuring network and information security
Conducting business analytics
Protecting against fraud

We always balance these interests against your rights and freedoms.

Consent

Where we rely on consent for processing activities (such as cookies), you have the right to withdraw that consent at any time.

Legal Obligation

We may process data when required by law, such as for tax or regulatory compliance purposes.

Your Data Protection Rights

Under UK GDPR, you have the following rights:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. We will respond to valid requests within one month.

Right to Rectification

You have the right to request correction of any personal data you believe is inaccurate or incomplete.

Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data in certain circumstances, including:

The data is no longer necessary for the purpose it was collected
You withdraw consent and there is no other legal basis for processing
You object to processing and there are no overriding legitimate grounds
The data was unlawfully processed

Note that this right is not absolute and may not apply if we have legal obligations to retain certain records.

Right to Restrict Processing

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of data or object to processing.

Right to Data Portability

You have the right to request transfer of your personal data to another organization or directly to you in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Upon receiving an objection, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

You have rights relating to automated decision-making and profiling. We do not currently use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at:

Email: [email protected]
Post: neo-savanna, 17 Charlotte Square, Edinburgh, EH2 4DF, United Kingdom

Please include the following information in your request:

Your full name
Your email address
A clear description of the right you wish to exercise
Any relevant details that will help us locate your information

We may need to verify your identity before processing your request. This is a security measure to ensure personal data is not disclosed to unauthorized persons.

Data Security

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of data in transit and at rest where appropriate
Regular security assessments and updates
Access controls ensuring only authorized personnel can access personal data
Staff training on data protection and security
Incident response procedures

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.

Typical retention periods include:

Consultation records: 7 years from last contact
Website analytics: 26 months
Email correspondence: As long as necessary for business purposes

When determining retention periods, we consider the amount, nature, and sensitivity of data, the potential risk of harm from unauthorized use or disclosure, and our legal obligations.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach where required by law.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

Adequacy decisions recognizing equivalent data protection standards
Standard contractual clauses approved by the UK authorities
Binding corporate rules where applicable

Children's Data

Our services are not directed at children under 18 years of age. We do not knowingly collect or process data from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it promptly.

Updates to This Information

We may update this GDPR compliance information from time to time to reflect changes in our practices or legal obligations. We will notify you of significant changes and update the "Last Updated" date at the top of this page.

Questions and Complaints

If you have questions about how we process your personal data or wish to make a complaint about our data protection practices, please contact us at [email protected].

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk

Contact for Data Protection Matters

For all data protection inquiries, including exercising your rights or raising concerns, please contact: