GDPR Compliance

Last updated: September 29, 2026

Our Commitment to Data Protection

reef-stoat.com is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page outlines our specific practices and your rights under these regulations.

Data Controller

For the purposes of data protection legislation, reef-stoat.com acts as the data controller for personal information collected through our website and services.

Contact details:
Email: [email protected]
Address: 47 Merchant Street, Bristol, BS1 3EE, United Kingdom

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The lawful bases we rely on include:

Contract (Article 6(1)(b))

Processing is necessary to fulfill our contract with you when you:

• Place an order for our products
• Request customer support
• Participate in our evaluation programs

Legitimate Interests (Article 6(1)(f))

We process data based on legitimate interests for:

• Website functionality and improvement
• Fraud prevention and security
• Understanding how our services are used
• Business analytics and optimization

We ensure these interests do not override your fundamental rights and freedoms.

Legal Obligation (Article 6(1)(c))

We process data to comply with legal requirements including:

• Tax and accounting regulations
• Consumer protection laws
• Product safety requirements

Consent (Article 6(1)(a))

We obtain explicit consent before:

• Sending marketing communications
• Using non-essential cookies
• Processing data for purposes not covered by other lawful bases

You can withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Your GDPR Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right to Access (Article 15)

You can request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information free of charge within one month of your request.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure (Article 17)

You can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

This right may be limited by legal obligations requiring us to retain certain data.

Right to Restriction (Article 18)

You can request limitation of processing when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability (Article 20)

You can receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller when processing is based on consent or contract and carried out by automated means.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. Please include:

• Your full name and contact information
• Description of your request
• Proof of identity (to protect your data security)

We will respond to requests within one month, though this may be extended by two months for complex requests.

Data Protection Principles

We adhere to GDPR's data protection principles, ensuring personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept only as long as necessary
• Processed securely

Data Security Measures

We implement appropriate technical and organizational measures including:

• Encryption of personal data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication requirements
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware
• Notify affected individuals without undue delay if the breach poses a high risk
• Document all breaches and our response

Third-Party Processing

When we engage third-party processors, we ensure they:

• Provide sufficient guarantees of GDPR compliance
• Process data only on our documented instructions
• Maintain appropriate security measures
• Assist with fulfilling data subject rights
• Delete or return data after the end of service provision

International Data Transfers

If we transfer your data outside the UK or EEA, we ensure appropriate safeguards through:

• Adequacy decisions by the relevant authorities
• Standard contractual clauses approved by regulatory bodies
• Binding corporate rules

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing violates GDPR.

UK supervisory authority:
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Updates to This Statement

We review and update this GDPR compliance statement regularly to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.