witty-vine
Home About Services Contact
Advertising Content

GDPR Compliance

Last updated: September 11, 2026

Our Commitment to Data Protection

witty-vine is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page outlines how we comply with these regulations and your rights as a data subject.

Data Controller

witty-vine acts as the data controller for personal information collected through this website and our business operations. We determine the purposes and means of processing your personal data.

Contact details:
witty-vine
47 Bloomsbury Street
London WC1B 3QE
United Kingdom
Email: [email protected]

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

1. Right to Be Informed

You have the right to know how your personal data is collected, used, and shared. We provide this information through our Privacy Policy and this GDPR page.

2. Right of Access

You can request a copy of the personal data we hold about you. We will provide this information within one month of your request, free of charge.

3. Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it.

4. Right to Erasure

Also known as the "right to be forgotten," you can request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes it was collected.

5. Right to Restrict Processing

You have the right to request that we limit how we use your personal data in certain situations, such as when you contest the accuracy of the data.

6. Right to Data Portability

You can request to receive your personal data in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller.

7. Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

8. Rights Related to Automated Decision Making

We do not currently use automated decision-making or profiling. Should this change, you will have the right not to be subject to decisions based solely on automated processing.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. Please include:

  • Your full name and contact details
  • Details of the right you wish to exercise
  • Any relevant information to help us locate your data

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so:

  • Consent: You have given clear consent for us to process your personal data for a specific purpose
  • Contract: Processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
  • Legal obligation: Processing is necessary for us to comply with the law
  • Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests

Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of personal data in transit and at rest
  • Regular security assessments and updates
  • Access controls and authentication measures
  • Staff training on data protection principles
  • Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay, and where feasible, within 72 hours of becoming aware of the breach.

International Data Transfers

When we transfer personal data outside the United Kingdom or European Economic Area, we ensure appropriate safeguards are in place, such as:

  • Standard contractual clauses approved by the European Commission
  • Transfers to countries with adequacy decisions
  • Other legally approved transfer mechanisms

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

  • Enquiry data: 3 years from last contact
  • Contract and project data: 7 years after project completion
  • Marketing consent records: Until consent is withdrawn
  • Website analytics: 26 months

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk

Updates to This Policy

We may update this GDPR compliance page from time to time to reflect changes in our practices or legal requirements. Please check this page periodically for updates.

witty-vine

Transforming cultural spaces since 2018

Navigation

  • Home
  • About
  • Services
  • Contact

Legal

  • Privacy Policy
  • GDPR
  • Cookies Policy
  • Terms of Use

Contact

[email protected]

London, United Kingdom

© 2026 witty-vine. All rights reserved.