GDPR Compliance Statement
Last Updated: September 29, 2026
Our Commitment to GDPR Compliance
Valley-hawk processes personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This statement outlines how we comply with these regulations and protect the rights of individuals whose data we process.
Legal Basis for Processing
We process personal data under the following lawful bases:
- Consent: When you submit enquiry forms or subscribe to communications, you provide explicit consent for us to process your information.
- Contract Performance: Processing is necessary to fulfil our contractual obligations when delivering services to clients.
- Legitimate Interests: We process data to improve our services and maintain business records, provided this does not override your rights and freedoms.
Data Subject Rights Under GDPR
You have the following rights regarding your personal data:
Right to Access
You may request a copy of the personal data we hold about you. We will provide this information within one month of receiving your request.
Right to Rectification
If you believe any information we hold about you is inaccurate or incomplete, you may request that we correct or complete it.
Right to Erasure
You may request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent upon which processing is based.
Right to Restriction of Processing
You may request that we restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability
Where technically feasible, you may request that we transfer your data to another organisation or provide it to you in a structured, commonly used format.
Right to Object
You may object to processing of your personal data where we rely on legitimate interests as the legal basis for processing.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling in our processing of personal data.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:
- Duration of active client engagements
- Legal and contractual record-keeping requirements (typically six years following project completion)
- Resolution of any disputes or claims
Once retention periods expire, personal data is securely deleted or anonymised.
Data Security Measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:
- Encryption of data in transit and at rest
- Access controls limiting data access to authorised personnel only
- Regular security assessments and updates
- Staff training on data protection principles and practices
International Data Transfers
Personal data is primarily stored and processed within the United Kingdom. If we need to transfer data internationally for specific project requirements, we ensure appropriate safeguards are in place as required by GDPR.
Third-Party Data Processors
We may engage third-party service providers to process personal data on our behalf for purposes such as website hosting or email communications. All such processors are contractually bound to process data only in accordance with our instructions and GDPR requirements.
Exercising Your Rights
To exercise any of your GDPR rights, please submit a written request to:
[email protected]
23 Merchant Street, Bristol, BS1 4HY, United Kingdom
We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will notify you of any such extension.
Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Contact Our Data Protection Officer
For questions regarding our GDPR compliance or data protection practices, you may contact our Data Protection Officer at [email protected].