GDPR Compliance

Data Controller Information

For the purposes of UK GDPR, the data controller is:

rustic-cove.com
47 Pemberton Gardens
Islington, London N19 5RR
United Kingdom
Email: [email protected]

Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

Right to Access (Article 15)

You have the right to obtain confirmation as to whether we process your personal data and, where that is the case, access to that data and information about how it is processed.

Right to Rectification (Article 16)

You have the right to obtain correction of inaccurate personal data and to have incomplete personal data completed.

Right to Erasure (Article 17)

In certain circumstances, you have the right to request deletion of your personal data. This right is not absolute and is subject to legal retention requirements applicable to legal service providers.

Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing of your personal data in specific circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects or significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, submit a request to [email protected] with the following information:

• Your full name and contact information
• Description of the specific right you wish to exercise
• Any relevant details about the personal data in question
• Proof of identity (if requested, to verify your identity)

We will respond to your request within one month of receipt, or within two months for complex requests. We will inform you if we need to extend the response period.

Legal Basis for Processing

We process personal data based on the following legal grounds under GDPR:

• Contractual necessity (Article 6(1)(b)): Processing is necessary to perform our contract with you for benefit consultation services
• Legal obligation (Article 6(1)(c)): Processing is necessary to comply with legal obligations governing legal service providers
• Legitimate interests (Article 6(1)(f)): Processing is necessary for our legitimate interests in maintaining accurate records and improving service quality
• Consent (Article 6(1)(a)): Where you have given explicit consent for specific processing activities

Special Category Data

We may process special category data (health information) for disability benefit applications. This processing is based on:

• Your explicit consent (Article 9(2)(a))
• Necessity for establishment, exercise, or defense of legal claims (Article 9(2)(f))
• Substantial public interest (Article 9(2)(g))

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication procedures
• Staff training on data protection obligations
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.

International Data Transfers

We do not transfer personal data outside the United Kingdom. All data processing occurs within UK jurisdiction.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Client files are retained for seven years after case closure in accordance with professional standards for legal services.

Third-Party Processing

When we engage third-party service providers who process personal data on our behalf, we ensure they provide appropriate guarantees regarding data protection and security through written contracts as required by Article 28 GDPR.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.

For the UK, the supervisory authority is:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Updates to GDPR Compliance

We regularly review our data processing activities to ensure ongoing GDPR compliance. This page will be updated to reflect any significant changes to our data protection practices.

Last updated: August 4, 2026