GDPR Compliance

Information about our compliance with the UK General Data Protection Regulation

Data Controller

Warmotter acts as the data controller for personal information collected through this website and in the course of providing environmental consulting services. We are responsible for ensuring that personal data is processed lawfully, fairly, and transparently.

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by UK GDPR:

• Consent: When you voluntarily provide information through contact forms or accept cookies
• Contract: When processing is necessary for the performance of consulting services you have engaged
• Legal obligation: When we must process data to comply with environmental reporting, tax, or other legal requirements
• Legitimate interests: For business operations, website improvement, and fraud prevention, provided these interests do not override your fundamental rights

Data Subject Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You may request confirmation of whether we process your personal data and obtain a copy of that data along with supplementary information about how it is processed.

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected or completed.

Right to Erasure

In certain circumstances, you may request deletion of your personal data, including when it is no longer necessary for the purposes for which it was collected or if you withdraw consent.

Right to Restriction of Processing

You may request that we limit the processing of your personal data in specific situations, such as when accuracy is contested or processing is unlawful.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request, though this may be extended by two further months for complex requests. We will inform you of any such extension and the reasons for it.

We may require proof of identity before processing requests to protect against fraudulent access to personal data.

Data Protection Principles

We adhere to the following data protection principles:

• Lawfulness, fairness, and transparency in all processing activities
• Purpose limitation: data collected for specified, explicit, legitimate purposes
• Data minimisation: only collecting data that is adequate, relevant, and necessary
• Accuracy: keeping personal data accurate and up to date
• Storage limitation: retaining data only as long as necessary
• Integrity and confidentiality: appropriate security measures to protect data

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also inform affected individuals without undue delay.

International Data Transfers

We primarily process data within the United Kingdom. Any transfers to countries outside the UK would only take place with appropriate safeguards such as adequacy decisions, standard contractual clauses, or binding corporate rules.

Children's Data

Our services are not directed at children under 16, and we do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

Complaints

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to GDPR Compliance

We regularly review our data protection practices to ensure ongoing compliance with UK GDPR and evolving regulatory guidance. This page was last updated on 30 September 2026.