GDPR Compliance

1. Our Commitment to Data Protection

bamboo-wren is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our data protection responsibilities seriously and implement appropriate measures to safeguard your personal information.

2. Data Controller Information

For the purposes of UK GDPR, the data controller is:

bamboo-wren
47 Wellington Street
Sheffield S1 4HG
United Kingdom
Email: [email protected]

3. Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. Our processing activities are based on:

3.1 Contract Performance

Processing is necessary to fulfil our contractual obligations when you rent a vehicle from us. This includes:

• Processing reservation requests and confirmations
• Verifying driver eligibility and insurance requirements
• Managing vehicle collection and return
• Processing security deposits and refunds

3.2 Legal Obligation

We are required by UK law to process and retain certain information:

• Financial records for tax purposes (7 years retention)
• Driver licence verification records
• Insurance documentation

3.3 Legitimate Interests

We process certain data based on legitimate business interests, balanced against your privacy rights:

• Website functionality and security
• Fraud prevention and detection
• Business analytics for service improvement

4. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

4.1 Right to Access

You can request a copy of all personal data we hold about you. We will provide this within one month of receiving a valid request, free of charge.

4.2 Right to Rectification

If personal data we hold is inaccurate or incomplete, you can request correction or completion. We will update records within one month.

4.3 Right to Erasure

You can request deletion of your personal data when:

• Data is no longer necessary for the purpose it was collected
• You withdraw consent (where consent was the lawful basis)
• You object to processing and there are no overriding legitimate grounds
• Data has been unlawfully processed

Note: We may be required to retain certain data to comply with legal obligations (e.g., tax records).

4.4 Right to Restriction of Processing

You can request that we restrict processing of your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

4.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

4.6 Right to Object

You can object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

5. How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with:

• Clear description of the right you wish to exercise
• Sufficient information to verify your identity
• Any relevant details to help us locate your data

We will respond within one month. If your request is complex or we receive multiple requests, we may extend this by two months and will inform you of the extension and reasons.

6. Data Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorised personnel only
• Regular security assessments and updates
• Staff training on data protection principles
• Secure backup procedures
• Incident response procedures

7. Data Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
• Notify affected individuals without undue delay if the breach poses high risk
• Provide clear description of the breach nature and likely consequences
• Communicate measures taken or proposed to address the breach

8. Data Processor Agreements

Where we engage third-party service providers to process data on our behalf, we ensure:

• Formal data processing agreements are in place
• Processors provide sufficient guarantees of appropriate security measures
• Processors only process data according to documented instructions
• Regular audits of processor compliance

9. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. All vehicle rental customers must be at least 21 years old with a minimum of 2 years driving experience.

10. International Data Transfers

Your personal data is processed and stored exclusively within the United Kingdom. We do not transfer data outside the UK or European Economic Area.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you. All rental decisions involve human review.

12. Data Protection Officer

For questions specifically about data protection or GDPR compliance, you may contact our designated data protection representative at [email protected].

13. Complaints

If you believe we have not handled your data in accordance with UK GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk

14. Policy Updates

This GDPR compliance statement may be updated to reflect changes in data protection legislation or our processing activities. Significant changes will be communicated to existing clients via email. The last update date is shown at the top of this page.