GDPR Compliance

Last updated: June 19, 2026

Our Commitment to Data Protection

willow-loop is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the protection of your personal data seriously and implement appropriate measures to ensure compliance.

Data Controller

willow-loop is the data controller responsible for your personal data. Our contact details are:

willow-loop
42 Wellington Street
Leeds LS1 4HZ
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract: When processing is necessary to perform a contract with you
• Legitimate Interests: When we have a legitimate interest in processing your data that does not override your rights
• Legal Obligation: When we must process data to comply with legal requirements

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this within one month of your request.

Right to Rectification

You can request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You may request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing

You can ask us to restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.

Right to Object

You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not currently engage in automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive multiple requests, this may be extended by up to two months, and we will inform you of any such extension.

Right to Lodge a Complaint

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: www.ico.org.uk

Data Protection Principles

We ensure that personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept only for as long as necessary
• Processed in a manner that ensures appropriate security

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of the breach.

Third-Party Processing

When we engage third-party processors, we ensure they provide sufficient guarantees to implement appropriate technical and organizational measures to meet UK GDPR requirements.

Updates to This Page

We may update this GDPR compliance statement from time to time to reflect changes in our practices or legal requirements.