GDPR Compliance Statement

Last Updated: September 23, 2026

Our Commitment

corviqen-core is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (GDPR) and UK data protection legislation. This statement outlines how we comply with these regulations.

Data Controller

corviqen-core acts as the data controller for personal information collected through our website and business activities. We determine the purposes and means of processing your personal data.

Contact details:
corviqen-core
142 Thornbury Street
Bristol BS2 9LQ
United Kingdom
[email protected]

Lawful Basis for Processing

We process personal data only when we have a valid legal basis:

• Consent: When you voluntarily provide information through forms or accept cookies
• Contract: When processing is necessary to deliver services you have requested
• Legitimate Interests: For business operations, security, and service improvement where your rights are not overridden
• Legal Obligation: When required by law to retain or process certain information

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this within one month of receiving your request.

Right to Rectification

You may request correction of inaccurate or incomplete personal data. We will update our records promptly upon verification.

Right to Erasure

You can request deletion of your personal data when it is no longer necessary for the purposes collected, or when you withdraw consent. Certain legal obligations may prevent immediate deletion in some circumstances.

Right to Restrict Processing

You may request that we limit how we use your personal data while issues regarding accuracy or lawfulness are resolved.

Right to Data Portability

You can request your personal data in a structured, commonly used format for transfer to another organization where technically feasible.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless compelling legitimate grounds override your interests.

Rights Related to Automated Decision Making

We do not use automated decision making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of these rights, send a written request to [email protected] or our postal address listed above. Please include:

• Your full name and contact information
• Description of the right you wish to exercise
• Any relevant details to help us locate your information

We will respond within one month. In complex cases, this may be extended by two additional months with notification.

Data Protection Principles

We adhere to GDPR principles ensuring personal data is:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Retained only as long as necessary
• Processed securely with appropriate technical and organizational measures

Data Security Measures

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest where appropriate
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Staff training on data protection requirements
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the appropriate supervisory authority within 72 hours and inform affected individuals without undue delay as required by GDPR.

International Data Transfers

When personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place through:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Other legally valid transfer mechanisms

Third-Party Processing

Service providers who process data on our behalf are carefully selected and bound by data processing agreements ensuring GDPR compliance. We remain responsible for their processing activities.

Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the information promptly.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: www.ico.org.uk

Policy Updates

This statement may be updated to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.