GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights.

Right of access

You can request a copy of the personal data we hold about you and information about how it is used.

Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure

You can request that we delete your personal data where there is no lawful reason for us to continue processing it.

Right to restrict processing

You can ask us to limit how we use your data in certain circumstances, for example while a complaint is being investigated.

Right to object

You can object to processing based on our legitimate interests and to any direct marketing at any time.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

Right to withdraw consent

Where we rely on consent (for example, certain cookies or marketing communications), you can withdraw it at any time.

Some rights may be limited where exemptions apply under data protection law.

To exercise any of your rights, please contact us:

Email: [TBC – privacy@newpurple.co.uk

]

Address: [TBC – registered address]

Please include:

• your name and contact details
• the email address or information you used when interacting with us
• a clear description of your request

We may contact you to clarify your request if necessary.

There is normally no fee for making a request.

To protect your privacy and security, we may need to confirm your identity before processing certain requests.

This may involve asking for:

• confirmation of contact details, or
• additional information to verify your identity
• We will only request information that is reasonable and necessary for verification purposes.

If we are unable to verify your identity, we may not be able to fulfil your request.

We aim to respond to all valid requests as quickly as possible.

Under UK GDPR:

• We will normally respond within one month of receiving your request.
• If your request is complex or you have made multiple requests, we may extend this period by up to two additional months.
• If an extension is required, we will inform you within the first month and explain the reason.

In certain circumstances, data protection law allows organisations to refuse or limit a request. For example:

• where the request is manifestly unfounded or excessive
• where complying would adversely affect the rights and freedoms of others
• where we are required to retain data for legal, regulatory, or contractual reasons
• where legal exemptions apply (for example, for accounting records, legal claims, or regulatory obligations)

If we refuse or limit a request, we will explain our reasons and inform you of your right to complain.

You have the right to object to direct marketing at any time.

You can:

• use the unsubscribe link in marketing emails, or
• contact us at [TBC privacy email]

For cookie preferences, you can update your choices via the cookie settings tool on our website: [TBC link/button]

For more information, see our Privacy Policy and Cookie Policy.

Where your personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR.

These may include:

UK International Data Transfer Agreements (IDTA)

UK Addendum to EU Standard Contractual Clauses

other lawful transfer mechanisms

You can contact us if you would like more information about these safeguards.

If you have any concerns about how we handle your personal data, please contact us first so we can try to resolve the issue:

Email: [TBC privacy email]

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Website: www.ico.org.uk

Telephone: 0303 123 1113

We may update this page from time to time to reflect changes in our practices or legal requirements.

The “Last updated” date at the top shows when this page was last revised.