GDPR Compliance

Last updated: November 3, 2026

1. General Data Protection Regulation (GDPR)

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

2. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you submit forms or accept cookies
• Contractual necessity: To provide services you request
• Legitimate interests: To improve our services and communicate relevant information
• Legal obligation: To comply with applicable laws and regulations

3. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data when it is no longer necessary for the purposes collected or when you withdraw consent.

Right to Restriction of Processing

You can request limitation of processing under certain circumstances.

Right to Data Portability

You can request your personal data in a structured, commonly used, machine-readable format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects.

4. Data Protection Officer

For questions about data protection or to exercise your GDPR rights, contact:

Email: dpo@velvet-sequoia.com
Address: 12 Thornhill Crescent, Edinburgh, EH3 6NR, United Kingdom

5. Data Transfers

We do not transfer personal data outside the UK or European Economic Area (EEA). If such transfers become necessary, we will implement appropriate safeguards.

6. Data Breach Notification

In the event of a data breach that may result in risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR.

7. Data Retention Periods

We retain personal data only as long as necessary:

• Inquiry forms: 3 years from last contact
• Service contracts: Duration of service plus 6 years for legal purposes
• Cookie data: As specified in our Cookies Policy

8. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority:

UK Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

9. How to Exercise Your Rights

To exercise any of your GDPR rights, please submit a written request to:

Email: gdpr-requests@velvet-sequoia.com
Post: GDPR Requests, 12 Thornhill Crescent, Edinburgh, EH3 6NR, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this period by two additional months with notification.

10. Updates to This Information

This GDPR compliance information may be updated to reflect changes in our practices or legal requirements. Check this page periodically for updates.