GDPR Compliance

Last updated: 17 June 2026

atoll eagle is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we meet our obligations under these regulations.

Data Controller

atoll eagle acts as the data controller for personal data collected through this website and in the course of providing our services. This means we determine the purposes and means of processing your personal data.

Contact:
atoll eagle
71-75 Shelton Street
London, WC2H 9JQ
United Kingdom
Email: [email protected]

Principles of Data Processing

We adhere to the following principles when processing personal data:

• Lawfulness, fairness, and transparency: We process data lawfully and openly inform you about how we use it
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes
• Data minimisation: We only collect data that is necessary for the stated purposes
• Accuracy: We take reasonable steps to ensure data is accurate and up to date
• Storage limitation: We retain data only as long as necessary
• Integrity and confidentiality: We implement appropriate security measures
• Accountability: We can demonstrate compliance with these principles

Lawful Bases for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

Consent (Article 6(1)(a))

Where you have given clear consent for us to process your personal data for specific purposes, such as receiving marketing communications or submitting enquiry forms.

Contractual Necessity (Article 6(1)(b))

Where processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract, such as when you engage our consultancy services.

Legal Obligation (Article 6(1)(c))

Where processing is necessary to comply with our legal obligations, such as maintaining financial records or responding to regulatory enquiries.

Legitimate Interests (Article 6(1)(f))

Where processing is necessary for our legitimate business interests, provided these interests do not override your fundamental rights. This includes improving our services and maintaining website security.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about the processing.

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes collected.

Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing in certain circumstances, such as where you contest the accuracy of your data.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you. We do not currently use automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases or where we receive multiple requests, this period may be extended by a further two months, in which case we will inform you.

We may request verification of your identity before processing your request to ensure data security.

Data Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the Information Commissioner's Office.

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

Data Protection Officer

Given the nature and scale of our operations, we are not required to appoint a Data Protection Officer. However, for all data protection matters, please contact us at [email protected].

Complaints

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

Updates to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. The date at the top of this page indicates when it was last updated.