GDPR Compliance

Our Commitment to GDPR Compliance

lush-otter.com is committed to full compliance with the General Data Protection Regulation (GDPR). We respect your privacy rights and have implemented comprehensive measures to ensure your personal data is processed lawfully, fairly, and transparently.

Data Controller Information

For the purposes of GDPR, the data controller is:

lush-otter
15 Camden Row
Dublin 8, D08 HF32
Ireland
Email: [email protected]

What Personal Data We Collect

We collect and process the following categories of personal data:

• Identity Data: Name, professional title
• Contact Data: Email address, postal address
• Technical Data: IP address, browser type, device information, cookie identifiers
• Usage Data: Website navigation patterns, page interactions, time spent on pages
• Communication Data: Content of inquiries submitted through our forms

Legal Basis for Processing

We process your personal data under the following legal grounds:

• Article 6(1)(a) - Consent: When you voluntarily provide information through forms or accept cookies
• Article 6(1)(b) - Contract: When necessary to respond to service inquiries or fulfill agreements
• Article 6(1)(f) - Legitimate Interests: For website analytics, security, and service improvement

Your GDPR Rights

Under GDPR, you have the following rights:

Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is being processed.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure (Article 17)

Also known as the "right to be forgotten," you can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability (Article 20)

You can receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller when processing is based on consent or contract and carried out by automated means.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. We do not engage in such automated decision-making.

Right to Withdraw Consent (Article 7)

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, submit a request to [email protected] with the subject line "GDPR Rights Request." Please include:

• Your full name and contact information
• Description of the specific right you wish to exercise
• Any relevant details to help us locate your data

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will notify you of the extension.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection principles
• Data breach response procedures

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Inquiry and communication data: 24 months after last interaction
• Analytics data: Anonymized after 14 months
• Cookie data: As specified in our Cookies Policy
• Legal and accounting records: As required by Irish law (typically 7 years)

International Data Transfers

Your data is primarily processed within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards through:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally compliant transfer mechanisms

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required, within 72 hours of becoming aware of the breach, in accordance with Article 33 of GDPR.

Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Irish Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Phone: +353 (0)761 104 800
Website: www.dataprotection.ie

Updates to GDPR Compliance

We regularly review our data protection practices to ensure ongoing compliance with GDPR. Any material changes to our compliance approach will be communicated through updates to this page and our Privacy Policy.

Contact for Data Protection Matters

For questions, concerns, or requests related to GDPR and data protection, contact us at:

Email: [email protected]
Subject: GDPR Inquiry
Address: 15 Camden Row, Dublin 8, D08 HF32, Ireland