GDPR Compliance

Our Commitment to Data Protection

pine-sage is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet our obligations and your rights under these regulations.

Data Controller Information

pine-sage acts as the data controller for personal information collected through our website and services. We are responsible for deciding how personal data is collected, used, and protected.

Contact for data protection matters: [email protected]

Lawful Basis for Processing

We only process personal data where we have a lawful basis to do so. The bases we rely on include:

Contractual Necessity

When you engage our services, we process your data as necessary to fulfil our agreement with you. This includes collecting information needed to prepare benefit applications and represent you in appeals.

Consent

For certain types of processing, we will ask for your explicit consent. You may withdraw consent at any time, though this will not affect the lawfulness of processing carried out before withdrawal.

Legitimate Interests

We may process data where we have a legitimate business interest, such as improving our services or maintaining security, provided this does not override your fundamental rights and freedoms.

Legal Obligation

We process data where required to comply with UK law, including financial record-keeping requirements and responding to lawful requests from authorities.

Your Rights Under UK GDPR

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this within one month of receiving your request. There is no fee for most requests, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will respond to rectification requests within one month.

Right to Erasure

In certain circumstances, you can request that we delete your personal data. This right is not absolute and applies where, for example, the data is no longer needed for its original purpose or you withdraw consent. We may be required to retain certain data for legal or regulatory reasons.

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as while we investigate a complaint about accuracy.

Right to Data Portability

Where we process data based on consent or contract, and processing is automated, you have the right to receive your data in a structured, commonly used format and to have it transmitted to another controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making of this nature.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We aim to respond to all requests within one month, though complex requests may require an extension of up to two additional months.

Special Category Data

Benefits work often involves processing special category data, particularly health information. We process such data only with your explicit consent or where necessary to establish, exercise, or defend legal claims on your behalf.

International Transfers

We primarily process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Data Breach Notification

We maintain procedures to detect, investigate, and respond to personal data breaches. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

Supervisory Authority

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We encourage you to contact us first so we can address your concerns directly.

Last updated: January 2024