GDPR Compliance Statement

Our Commitment to Data Protection

Harbor-cosmos is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We process personal data lawfully, fairly, and transparently while respecting your rights as a data subject.

Data Controller Information

Harbor-cosmos acts as the data controller for personal information collected through our website and services. Our contact details are:

Harbor-cosmos
47 Riverside Industrial Estate
Southampton, SO15 4JN
United Kingdom
Email: [email protected]

Your GDPR Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format within one month of receiving your request.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you can request correction. We will respond to your request within one month.

Right to Erasure

You may request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You can request that we temporarily restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transfer this data directly to another controller where technically feasible.

Right to Object

You can object to processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing conducted before consent was withdrawn.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data appropriately.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us using the details provided above. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

We may request proof of identity to ensure we provide personal data only to the correct individual.

Lawful Basis for Processing

We process personal data based on the following lawful bases:

• Consent: When you submit forms or accept cookies
• Contract: To fulfill service requests you make
• Legitimate Interests: To operate and improve our business, prevent fraud, and maintain security
• Legal Obligation: To comply with applicable laws and regulations

Data Processing Activities

We process personal data for the following purposes:

• Processing and responding to service requests
• Communicating with customers about services
• Maintaining website functionality and security
• Analyzing website usage to improve user experience
• Complying with legal and regulatory requirements

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law:

• Service request data: 7 years (business records retention requirement)
• Website usage data: 2 years
• Email correspondence: 3 years
• Cookie data: As specified in our Cookies Policy

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel only
• Regular security assessments and updates
• Staff training on data protection principles
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

Third-Party Processors

Where we engage third-party service providers to process personal data on our behalf, we ensure they provide appropriate safeguards through contractual agreements that meet GDPR requirements.

International Data Transfers

If we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Binding corporate rules where applicable

Children's Data

We do not knowingly collect or process personal data from individuals under 16 years of age without parental consent.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our data processing activities or legal requirements. The current version will always be available on our website with the last updated date displayed.

Contact the ICO

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk