GDPR Compliance
Our commitment to data protection
Last updated: September 2026
1. Our Commitment to GDPR
lush-blossom is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our responsibilities regarding the protection of personal data seriously and have implemented appropriate measures to ensure compliance.
2. Data Controller Information
For the purposes of data protection legislation, the data controller is:
lush-blossom
47 Commerce Street
Manchester, M2 4LQ
United Kingdom
Email: [email protected]
3. Types of Personal Data We Process
We may process the following categories of personal data:
- Identity Data: Name, title, job role
- Contact Data: Email address, business address
- Technical Data: IP address, browser type, device information
- Usage Data: Information about how you use our website
- Communication Data: Content of correspondence with us
4. Lawful Bases for Processing
We only process personal data where we have a lawful basis to do so. The lawful bases we rely on include:
- Consent: You have given clear consent for us to process your personal data for a specific purpose
- Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
- Legal Obligation: Processing is necessary for us to comply with the law
- Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests
5. Your Data Protection Rights
Under GDPR, you have the following rights:
5.1 Right of Access
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to your request within one month.
5.2 Right to Rectification
You have the right to request that we correct any personal data that is inaccurate or incomplete.
5.3 Right to Erasure
You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.
5.4 Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
5.5 Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
5.6 Right to Object
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
5.7 Rights Related to Automated Decision Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
6. How to Exercise Your Rights
To exercise any of the above rights, please contact us at:
Email: [email protected]
We will respond to your request within one month. In complex cases, we may extend this period by a further two months, and we will inform you if this is the case.
We do not charge a fee for responding to rights requests unless the request is manifestly unfounded or excessive.
7. Data Security Measures
We have implemented appropriate technical and organisational measures to protect personal data, including:
- Encryption of data in transit and at rest where appropriate
- Access controls to limit who can access personal data
- Regular security assessments and testing
- Staff training on data protection
- Incident response procedures
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are based on:
- Legal and regulatory requirements
- Contractual obligations
- Operational needs
When personal data is no longer required, we securely delete or anonymise it.
9. International Data Transfers
Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:
- Adequacy decisions by the UK Government
- Standard Contractual Clauses
- Binding Corporate Rules
10. Complaints
If you are not satisfied with how we handle your personal data or respond to your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
11. Changes to This Policy
We may update this GDPR Compliance page from time to time. We encourage you to review this page periodically for the latest information on our data protection practices.