Your data protection rights under UK GDPR
The General Data Protection Regulation (GDPR), as retained in UK law following Brexit, provides comprehensive data protection rights for individuals. At crisp-spire, we are fully committed to upholding these rights and ensuring transparency in how we handle your personal data.
The UK GDPR, together with the Data Protection Act 2018, forms the framework for data protection in the United Kingdom. These regulations give you significant control over your personal information and impose strict obligations on organisations that process personal data.
As a benefits and pension consultancy, we frequently handle sensitive personal information. We take our responsibilities under data protection law seriously and have implemented robust measures to protect your data.
Under UK GDPR, we adhere to the following data protection principles:
You have the right to know how your personal data is being used. This includes information about who is collecting your data, what it will be used for, and who it may be shared with. Our Privacy Policy provides this information in full.
You can request a copy of all personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond to your request within one month and provide the information free of charge in most circumstances.
If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction. We will address such requests promptly to ensure our records remain accurate.
Also known as the right to be forgotten, this allows you to request deletion of your personal data in certain circumstances. These include situations where the data is no longer necessary for its original purpose or where you withdraw consent. However, we may need to retain certain data to comply with legal obligations.
You can request that we limit how we use your data. This right applies in specific situations, such as when you contest the accuracy of your data or object to its processing while we verify whether our legitimate interests override yours.
Where technically feasible, you can request to receive your personal data in a structured, commonly used, machine-readable format. You may also request that we transmit this data directly to another organisation.
You have the right to object to processing of your personal data in certain circumstances, including processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. At crisp-spire, we do not use automated decision-making processes that would trigger this right.
In the course of providing our services, we may process special category data, including health information relevant to disability benefit claims. This data receives additional protection under UK GDPR. We process such data only with your explicit consent and where necessary to provide our services.
To exercise any of your data protection rights, please contact us:
Please provide sufficient information to verify your identity and specify which right you wish to exercise. We aim to respond to all requests within one month. If your request is complex, we may extend this period by up to two further months, in which case we will inform you of the extension and the reasons for it.
If you believe we have not handled your personal data appropriately, we encourage you to contact us first so we can address your concerns. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
The ICO can be contacted at:
We may update this GDPR information page from time to time to reflect changes in legislation or our practices. Please check back periodically to stay informed about your rights and how we protect your data.
Last updated: August 2024