GDPR Compliance

Last Updated: June 19, 2026

Data Controller Information

emberglint-dragon operates as the data controller for personal information collected through this website and during service provision. We are committed to protecting your privacy rights under the General Data Protection Regulation (GDPR).

Legal Basis for Processing

We process personal data under the following legal grounds:

• Contract Performance: Processing necessary to fulfill service bookings and appointments
• Legitimate Interests: Maintaining service records, improving service quality, and managing customer relationships
• Consent: Marketing communications (where explicitly provided)
• Legal Obligation: Compliance with accounting, tax, and safety regulations

Your GDPR Rights

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a structured, commonly used format within 30 days of your request.

Right to Rectification

If personal information we hold is inaccurate or incomplete, you have the right to request correction. We will update records within 30 days of notification.

Right to Erasure

You may request deletion of personal data under certain circumstances, including when data is no longer necessary for the purposes collected, or you withdraw consent. Some data may be retained where legal obligations require.

Right to Restriction of Processing

You can request limitation on how we use your data while we verify accuracy, assess legal grounds for processing, or during objection proceedings.

Right to Data Portability

For data processed based on consent or contract performance, you may request transfer of your information to another service provider in a machine-readable format.

Right to Object

You may object to processing based on legitimate interests. We will cease processing unless compelling legitimate grounds override your interests or we need the data for legal claims.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Data Protection Measures

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Staff training on data protection responsibilities
• Incident response procedures for potential data breaches

International Data Transfers

Personal data is stored and processed within the United Kingdom and European Economic Area. Any transfers outside these regions would only occur with appropriate safeguards such as Standard Contractual Clauses.

Data Breach Notification

In the event of a data breach likely to result in risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, along with details of the incident and measures taken.

Exercising Your Rights

To exercise any GDPR rights, submit a request to: [email protected]

We will verify your identity before processing requests and respond within 30 days. Complex requests may require an extension, which we will communicate clearly.

Complaints

If you believe we have not handled your data in accordance with GDPR requirements, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

ICO Contact: [email protected] or visit www.ico.org.uk