GDPR Compliance Information

Our Commitment to Data Protection

Witty-atoll is committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines our compliance approach and your rights as a data subject.

Data Controller Information

Witty-atoll acts as the data controller for personal information collected through our website and booking services. We determine the purposes and means of processing your personal data.

Contact details:
Witty-atoll
45 Camden Passage
London, N1 8EA
United Kingdom
Email: [email protected]

Lawful Bases for Processing

We process personal data only when we have a lawful basis to do so:

1. Consent

When you explicitly agree to processing for specific purposes, such as receiving newsletters or promotional materials. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

2. Contract

Processing necessary to fulfill our service agreement with you, including:

• Processing tour bookings
• Communicating about scheduled tours
• Providing customer support related to your booking

3. Legal Obligation

Processing required to comply with legal requirements, such as financial record-keeping for tax purposes or responding to lawful requests from authorities.

4. Legitimate Interests

Processing necessary for our legitimate business interests, provided these interests do not override your fundamental rights and freedoms. Examples include:

• Preventing fraud and ensuring security
• Analyzing website usage to improve services
• Managing business operations efficiently

Your Rights Under UK GDPR

Right of Access

You have the right to request confirmation of whether we process your personal data and to receive a copy of that data. We will provide this information within one month of a valid request, free of charge for the first copy.

Right to Rectification

If personal data we hold is inaccurate or incomplete, you have the right to request correction or completion. We will make necessary amendments promptly and notify any third parties to whom the data was disclosed.

Right to Erasure

You may request deletion of your personal data in the following circumstances:

• Data is no longer necessary for the purposes for which it was collected
• You withdraw consent and no other legal basis applies
• You object to processing and no overriding legitimate grounds exist
• Data has been unlawfully processed
• Erasure is required to comply with a legal obligation

This right is not absolute. We may need to retain certain information to comply with legal obligations or establish, exercise, or defend legal claims.

Right to Restriction of Processing

You may request limitation of processing when:

• You contest the accuracy of data during verification
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing relates to legal claims.

Rights Related to Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects individuals. All booking decisions and customer interactions involve human review.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with sufficient information to verify your identity. We may request additional information if necessary to confirm your identity and prevent unauthorized disclosure.

We will respond to valid requests within one month. In complex cases or when we receive multiple requests, we may extend this period by two additional months, informing you of the extension and reasons within the initial month.

Data Protection Principles

We adhere to the following data protection principles:

• Lawfulness, Fairness, Transparency: Processing data legally, fairly, and transparently
• Purpose Limitation: Collecting data for specified, explicit, legitimate purposes only
• Data Minimization: Processing only adequate, relevant data necessary for stated purposes
• Accuracy: Maintaining accurate and current personal data
• Storage Limitation: Retaining data only as long as necessary
• Integrity and Confidentiality: Protecting data through appropriate security measures
• Accountability: Demonstrating compliance with these principles

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication requirements
• Employee training on data protection obligations
• Incident response procedures

Data Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office within 72 hours of becoming aware of a breach where required.

International Data Transfers

Personal data is primarily stored and processed within the United Kingdom. If international transfer becomes necessary, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by authorities
• Binding corporate rules
• Approved certification mechanisms

Third-Party Processing

When we engage third-party processors, we ensure they provide sufficient guarantees of GDPR compliance through written contracts that specify:

• Processing only on our documented instructions
• Confidentiality obligations for personnel
• Appropriate security measures
• Sub-processor engagement conditions
• Assistance with data subject rights requests
• Data return or deletion at contract end

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Policy Updates

We review and update our GDPR compliance procedures regularly to reflect changes in legislation, business practices, or technological developments. Material changes will be communicated through our website and, where appropriate, via direct notification to affected individuals.