GDPR Compliance Statement

Our Commitment to Data Protection

vine-crane is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document outlines how we meet our obligations as a data controller and respect your rights as a data subject.

Data Controller Information

vine-crane acts as the data controller for personal information collected through our services and website.

Contact details:
vine-crane
47 Deansgate
Manchester M3 2AY
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis under Article 6 of UK GDPR:

• Performance of a contract: Processing necessary to provide benefit application services you have requested
• Legal obligation: Processing required to comply with UK legal requirements, including submission of applications to government authorities
• Consent: Explicit consent for specific processing activities such as marketing communications
• Legitimate interests: Processing necessary for our legitimate business interests, provided these do not override your fundamental rights

Special Category Data

Benefit applications often require processing of special category data (sensitive personal information) as defined in Article 9 of UK GDPR, including:

• Health information
• Information about disabilities
• Financial hardship circumstances

We process special category data only when necessary for:

• Performance of obligations in the field of social security law
• Establishment, exercise, or defense of legal claims
• Explicit consent you provide for specific processing purposes

Data Subject Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to Be Informed

You have the right to clear information about how we collect and use your personal data. This information is provided in our Privacy Policy and this GDPR statement.

Right of Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request, free of charge, unless your request is manifestly unfounded or excessive.

Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update or complete the data within one month.

Right to Erasure

You can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

This right may be limited where we have legal obligations to retain data (such as for tax or regulatory purposes).

Right to Restrict Processing

You can request restriction of processing in certain circumstances:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of our legitimate grounds

Right to Data Portability

Where processing is based on consent or contract performance and is carried out by automated means, you can request that we provide your data in a structured, commonly used, machine-readable format, or transmit it directly to another controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision Making

We do not use automated decision making or profiling that produces legal effects or similarly significant effects on individuals.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us:

Email: [email protected]
Post: vine-crane, 47 Deansgate, Manchester M3 2AY

We will respond to your request within one month. In complex cases, we may extend this by two additional months, and we will inform you of any such extension.

You will not have to pay a fee to exercise your rights unless your request is clearly unfounded or excessive.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel only
• Regular security assessments and penetration testing
• Staff training on data protection principles and secure handling practices
• Secure disposal procedures for data no longer required
• Business continuity and disaster recovery plans

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk
• Document all data breaches regardless of whether notification is required

Data Protection by Design and Default

We implement data protection principles in the design of our systems and processes:

• Collecting only data that is necessary for specified purposes
• Limiting access to personal data to those who need it
• Ensuring data is accurate and kept up to date
• Retaining data only for as long as necessary
• Ensuring appropriate security measures are in place

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR, such as:

• Adequacy decisions recognizing equivalent data protection standards
• Standard contractual clauses approved by the UK authorities
• Binding corporate rules where applicable

Children's Data

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete that information.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing operations that are likely to result in high risk to individuals' rights and freedoms. This includes new technologies or processing special category data at scale.

Third-Party Processors

Where we use third-party service providers who process personal data on our behalf, we ensure:

• Written contracts are in place governing the processing
• Processors provide sufficient guarantees of appropriate technical and organizational measures
• Processors only act on our documented instructions
• Appropriate security measures are implemented

Right to Lodge a Complaint

If you believe we have not complied with UK GDPR or data protection law, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.