GDPR Information

Last Updated: June 19, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about your rights under data protection legislation and how we fulfill our obligations as a data controller.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

pebble-den
47 Granby Street
Leicester, LE1 6FB
United Kingdom
Email: [email protected]

What Personal Data We Process

We process personal data that you provide to us, including:

Contact information: name, email address, postal address
Communication records: consultation requests, email correspondence, inquiry details
Financial information: data provided during consultations for service delivery
Technical data: IP address, browser type, device information, cookies

Why We Process Your Data

We process personal data for the following purposes, based on applicable legal grounds:

Based on Consent

Processing consultation requests submitted through website forms
Sending information you have specifically requested
Using non-essential cookies and analytics

Based on Contractual Necessity

Providing financial management services you have engaged us for
Fulfilling obligations under service agreements
Processing payments and maintaining financial records

Based on Legitimate Interests

Responding to inquiries and consultation requests
Improving our website and service offerings
Preventing fraud and ensuring website security
Operating our business effectively

Based on Legal Obligations

Complying with financial services regulations
Maintaining records as required by professional standards
Responding to lawful requests from authorities

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a "subject access request." We will provide this information free of charge within one month of receiving a valid request.

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will make corrections within one month and notify any third parties with whom we've shared the data, where applicable.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

The data is no longer necessary for the purpose it was collected
You withdraw consent on which processing is based
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed

This right is not absolute and may be limited by legal or regulatory obligations that require us to retain certain information.

Right to Restriction of Processing

You can request that we restrict processing of your personal data in specific situations:

You contest the accuracy of the data
Processing is unlawful but you prefer restriction over erasure
We no longer need the data but you require it for legal claims
You have objected to processing and await verification of legitimate grounds

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. You also have the right to request that we transfer this data directly to another organization where technically feasible.

Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for legal claims.

Right to Withdraw Consent

Where we process personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not currently employ automated decision-making processes.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected] with:

Clear identification of which right you wish to exercise
Sufficient information to verify your identity
Specific details about your request

We will respond to valid requests within one month. In complex cases, we may extend this period by two additional months and will notify you of such extensions.

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

Encryption of data in transit and at rest
Access controls limiting data access to authorized personnel
Regular security assessments and updates
Staff training on data protection principles
Secure backup and recovery procedures

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods vary based on data type:

Consultation requests: 6 years from last contact
Client service records: 6 years following service completion
Email correspondence: 6 years from date of communication
Website analytics: Up to 24 months

International Data Transfers

We process personal data within the United Kingdom. If we need to transfer data outside the UK, we will ensure appropriate safeguards are in place in accordance with data protection legislation, such as standard contractual clauses or adequacy decisions.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay, providing information about the nature of the breach and measures taken or proposed.

Children's Data

Our services are not directed to children under the age of 18, and we do not knowingly collect or process personal data from children. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

Updates to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised date. We encourage you to review this information regularly.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, if you believe we have not handled your personal data appropriately or have not responded adequately to your requests.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk
Helpline: 0303 123 1113

Contact Us

If you have questions about how we process personal data or wish to exercise your rights, please contact us at:

Email: [email protected]
Address: 47 Granby Street, Leicester, LE1 6FB, United Kingdom