We may transfer, store and process your personal data outside the EEA. More detail can be found below.
Although Studio Can23 is based in the UK, some third-party providers, cloud services or analytics platforms may operate servers or subcontractors outside the UK and EEA. Whenever transferring your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it as under UK GDPR by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
- Where we use certain service providers located outside the UK or EEA we use specific contracts approved by the UK which give personal data the same protection it has in the UK and EEA.
Please contact us using the contact details stated at the end of this privacy notice if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.
Data security
All information you provide to us is stored on our secure servers located in the UK or EEA. Once we have received your information, we will use strict procedures and security features to try to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.
Data retention
By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.
In some circumstances you can ask us to delete your data: see below for further information.
Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Your legal rights
You have the following rights under data protection laws in relation to your personal data.
- Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.
- Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)
- Request us to delete or remove personal data where there is no good reason for us continuing to process it.
- Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.
- Request that we restrict or suspend our processing of your personal data:
- if you want us to establish the data’s accuracy;
- where our use of the data is unlawful, but you do not want us to erase it;
- where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
- you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
- Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.
- Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
- Complain to the UK data protection regulator. If you are unhappy with how we process your personal data, you should contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint to the ICO at any time.
You may request removal from our database by emailing us at hello@can23.com.
For details of your rights under data protection laws, including the right to receive a copy of the personal data we hold about you and the right to make a complaint at any time to the [Information Commissioner’s Office, the UK regulator for data protection issues https://ico.org.uk.