GDPR Compliance Statement

Last updated: September 8, 2026

Our Commitment to Data Protection

glenflare is committed to protecting personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. This statement outlines how we comply with data protection principles and safeguard the rights of data subjects.

Data Controller Information

glenflare acts as the data controller for personal information collected through our website and consulting engagements. We are responsible for determining how and why personal data is processed.

Data Protection Principles

We process personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes
• Data minimization: We collect only the data necessary for our stated purposes
• Accuracy: We take reasonable steps to ensure data is accurate and up to date
• Storage limitation: We retain data no longer than necessary for the purposes collected
• Integrity and confidentiality: We implement appropriate security measures to protect data
• Accountability: We are responsible for demonstrating compliance with these principles

Legal Bases for Processing

We rely on the following legal bases for processing personal data:

• Contract performance: Processing is necessary to fulfill our consulting agreements
• Legitimate interests: Processing is necessary for our legitimate business interests, balanced against individual rights
• Consent: You have given clear consent for specific processing activities
• Legal obligations: Processing is necessary to comply with legal requirements

Data Subject Rights

Under GDPR, individuals have the following rights regarding their personal data:

• Right of access: Request confirmation of whether we process your data and obtain a copy
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data in certain circumstances
• Right to restrict processing: Request limitation on how we use your data
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests or direct marketing
• Rights related to automated decision-making: We do not use automated decision-making or profiling

Exercising Your Rights

To exercise any of your data protection rights, please submit a written request to [email protected]. We will respond within one month of receiving your request. If your request is complex or we receive multiple requests, we may extend this period by two months and will notify you accordingly.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection responsibilities
• Incident response and data breach procedures

Data Breach Procedures

In the event of a data breach that poses a risk to individual rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Affected individuals will be notified without undue delay where the breach is likely to result in a high risk to their rights.

International Data Transfers

We process personal data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Third-Party Processors

Where we engage third-party service providers to process personal data on our behalf, we ensure they provide sufficient guarantees regarding data protection and security. We maintain written contracts with processors that specify their data protection obligations.

Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

Complaints and Supervisory Authority

If you believe we have not complied with data protection law, you have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection matters.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

Policy Updates

We review and update our data protection practices regularly to ensure ongoing compliance with GDPR. Material changes to this statement will be communicated through our website.

Contact for Data Protection Inquiries

For questions regarding our data protection practices or to exercise your rights, please contact us at [email protected].