GDPR Compliance

Last Updated: September 23, 2026

Our Commitment to Data Protection

atoll-works is committed to complying with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We take your privacy seriously and implement appropriate measures to ensure your personal data is processed lawfully, fairly, and transparently.

Data Controller Information

atoll-works acts as the data controller for personal information collected through our website and business operations. We are responsible for determining how and why your personal data is processed.

Data Controller: atoll-works
Address: 142 Argyle Street, Glasgow G2 8BG, United Kingdom
Email: [email protected]

Lawful Bases for Processing

We process personal data only when we have a lawful basis to do so. The primary legal bases we rely on include:

• Consent: You have given clear permission for us to process your data for specific purposes.
• Contractual Necessity: Processing is necessary to fulfill a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights and freedoms.
• Legal Obligation: Processing is required to comply with applicable laws and regulations.

Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

• Right to Access: You can request confirmation of whether we process your personal data and obtain a copy of it.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure: You can request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: You can request limitation of how we use your data.
• Right to Data Portability: You can request transfer of your data to another organization or directly to you.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making: You have rights regarding decisions made solely by automated means that significantly affect you.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two additional months for complex requests. We will inform you of any such extension and the reasons for the delay.

We may need to verify your identity before processing your request to ensure the security of your personal data.

Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or damage. These measures include:

• Encryption of data in transit and at rest where appropriate.
• Regular security assessments and updates.
• Access controls limiting data access to authorized personnel only.
• Staff training on data protection and security practices.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.

International Data Transfers

We primarily store and process personal data within the United Kingdom and European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods depend on the nature of the data and the purpose of processing.

Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: www.ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement periodically to reflect changes in our data processing practices or legal requirements. The date at the top of this page indicates when it was last updated.

Contact Us

For questions or concerns about our GDPR compliance or to exercise your data protection rights, please contact us at:

atoll-works
142 Argyle Street
Glasgow G2 8BG
United Kingdom
Email: [email protected]