GDPR Compliance

Our Commitment to GDPR

tundra-craft is fully committed to compliance with the General Data Protection Regulation and the UK Data Protection Act 2018. As a document verification service handling sensitive personal information, we recognize the importance of protecting your privacy and ensuring your data rights are respected.

We are registered with the Information Commissioner's Office as a data controller and maintain comprehensive data protection policies and procedures.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

tundra-craft
142 Pentonville Road
London, N1 9JE
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only where we have a lawful basis to do so under Article 6 of the GDPR:

• Consent (Article 6(1)(a)): You or the commissioning party has given clear consent for us to process your personal data for verification purposes
• Contract (Article 6(1)(b)): Processing is necessary for us to fulfill our contractual obligations to clients
• Legal Obligation (Article 6(1)(c)): Processing is necessary to comply with UK legal requirements
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for the legitimate interests of landlords and letting agents in assessing tenant suitability, provided this does not override your fundamental rights and freedoms

For special category data (such as information about health conditions that may affect housing needs), we process data only with explicit consent or where processing is necessary for substantial public interest purposes.

Your Rights Under GDPR

The GDPR provides you with extensive rights regarding your personal data. These rights are free to exercise in most cases.

Right to Be Informed

You have the right to clear, transparent information about how we use your personal data. This information is provided in our Privacy Policy and through fair processing notices when we collect your data.

Right of Access

You can request a copy of the personal data we hold about you, known as a Subject Access Request (SAR). We will provide this information within one month of receiving your request. The information will include:

• What personal data we are processing
• Why we are processing it
• Who it has been disclosed to
• How long we will retain it
• Your rights regarding the data

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will respond to rectification requests within one month and notify any third parties to whom the data has been disclosed.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

This right is not absolute. We may need to retain data to comply with legal obligations, establish or defend legal claims, or for other legitimate reasons.

Right to Restrict Processing

You can request that we limit how we use your data in certain situations:

• You contest the accuracy of the data
• Processing is unlawful but you do not want the data erased
• We no longer need the data but you need it for legal claims
• You have objected to processing and verification of legitimate grounds is pending

Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. You can request that we transmit this data directly to another controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

While our verification processes involve human assessment, if we implement automated decision-making or profiling in the future, you will have the right to request human intervention, express your point of view, and challenge the decision.

How to Exercise Your Rights

To exercise any of your GDPR rights, contact us using the following methods:

Email: [email protected]
Post: 142 Pentonville Road, London, N1 9JE, United Kingdom

Please include the following information in your request:

• Your full name and contact details
• Details of your specific request or the right you wish to exercise
• Any relevant reference numbers or dates related to our services
• Proof of identity (copy of passport or driving license)

We will respond to requests within one month. In complex cases, we may extend this by a further two months and will notify you if this is necessary.

Data Protection Principles

We adhere to the six key data protection principles under GDPR:

• Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes only
• Data minimization: We collect only data that is adequate, relevant, and limited to what is necessary
• Accuracy: We take reasonable steps to ensure data is accurate and kept up to date
• Storage limitation: We retain data only for as long as necessary for the purposes for which it was collected
• Integrity and confidentiality: We process data securely using appropriate technical and organizational measures

Data Security Measures

We implement comprehensive technical and organizational measures to ensure data security:

• ISO 27001 certified information security management system
• End-to-end encryption for data in transit and at rest
• Multi-factor authentication for system access
• Regular security audits and penetration testing
• Staff training on data protection and security procedures
• Incident response procedures for data breaches
• Regular backups with secure off-site storage
• Access controls limiting data access to authorized personnel

Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk
• Provide clear information about the nature of the breach and the measures taken to address it
• Offer advice on steps you can take to protect yourself

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals' rights and freedoms. Our DPIAs identify and mitigate privacy risks associated with new verification methodologies or technologies.

Third-Party Processors

Where we engage third-party service providers to process personal data on our behalf, we ensure:

• Written contracts are in place containing GDPR-compliant data processing terms
• Processors implement appropriate technical and organizational security measures
• Processors process data only on our documented instructions
• Processors assist with fulfilling data subject rights requests
• Processors notify us immediately of any data breaches

International Data Transfers

We store and process all personal data within the United Kingdom. We do not routinely transfer data to countries outside the UK. If international transfers become necessary in the future, we will ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the ICO
• Transfers to countries with adequacy decisions
• Other legally recognized transfer mechanisms

Contact and Complaints

If you have questions about our GDPR compliance or wish to make a complaint about how we handle your data, contact us at:

Email: [email protected]
Address: 142 Pentonville Road, London, N1 9JE, United Kingdom

You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113