GDPR Compliance
This document outlines how Marblethorn complies with the General Data Protection Regulation (GDPR) and UK data protection law.
Last updated: 8 September 2026
Data controller
Marblethorn is the data controller responsible for personal information collected through this website. Contact details:
Email: [email protected]
Address: 47 Division Street, Sheffield, S1 4GE, United Kingdom
Lawful basis for processing
We process personal information under the following lawful bases:
- Consent: When you voluntarily submit inquiry forms, you consent to the processing of your information for the purposes stated in our Privacy Policy
- Legitimate interests: We process information to respond to inquiries, maintain business records, and improve our services, which constitute legitimate business interests
- Legal obligation: We retain certain records to comply with financial, tax, and business regulations
Your rights under GDPR
You have the following rights regarding your personal information:
Right of access
You may request confirmation of whether we process your personal information and obtain a copy of that information.
Right to rectification
You may request correction of inaccurate or incomplete personal information.
Right to erasure
You may request deletion of your personal information in certain circumstances, including when it is no longer necessary for the purposes for which it was collected or when you withdraw consent.
Right to restriction of processing
You may request that we limit how we use your personal information in certain situations, such as when you contest the accuracy of the information or object to processing.
Right to data portability
You may request that we transfer your personal information to another organisation or provide it to you in a structured, commonly used format.
Right to object
You may object to processing of your personal information based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.
How to exercise your rights
To exercise any of these rights, send a request to [email protected]. Please include:
- Your full name and contact information
- Description of the right you wish to exercise
- Any relevant details that will help us locate your information
We will respond to requests within one month. If your request is complex or we receive multiple requests, we may extend this period by two months and will notify you of the extension.
Data protection by design
We implement data protection principles throughout our operations:
- We collect only information necessary for specified purposes
- We limit access to personal information to authorised personnel
- We implement technical and organisational security measures
- We review data processing activities regularly
Data transfers
Personal information collected through this website is stored within the United Kingdom. We do not transfer personal information outside the UK or European Economic Area.
Data breach notification
In the event of a data breach that poses risks to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.
Complaints
If you believe we have not handled your personal information in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
Contact
For questions about GDPR compliance or data protection practices, contact us at [email protected].