GDPR Information

Last updated: October 21, 2026

Our Commitment to Data Protection

brave-spire is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides detailed information about how we comply with data protection requirements and how you can exercise your rights.

Data Controller Information

brave-spire acts as the data controller for personal information collected through our website and business operations. We determine the purposes and means of processing your personal data.

Contact: [email protected]

Address: 42 Brunswick Street, Liverpool L2 0PL, United Kingdom

Lawful Basis for Processing

We only process personal data when we have a lawful basis to do so. The legal grounds we rely on include:

• Consent: You have explicitly agreed to our processing of your personal data for specific purposes, such as receiving marketing communications
• Contractual necessity: Processing is required to perform our consulting services and fulfill contractual obligations
• Legitimate interests: Processing is necessary for our legitimate business purposes, such as improving services, provided your rights and freedoms are not overridden
• Legal compliance: Processing is necessary to comply with legal obligations, including tax and accounting requirements

Your Data Protection Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format within one month of receiving your request.

Right to Rectification

You can request correction of any inaccurate or incomplete personal data we hold about you. We will make corrections within one month unless the request is complex.

Right to Erasure

In certain circumstances, you can request deletion of your personal data, including when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before consent was withdrawn.

How to Exercise Your Rights

To exercise any of your data protection rights, contact us at [email protected] with the subject line "Data Protection Request." Please include:

• Your full name and contact information
• Specific details about which right you wish to exercise
• Any relevant information to help us locate your data

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection obligations
• Incident response procedures for data breaches

Data Breach Notification

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office within 72 hours of becoming aware of the breach where required by law.

Data Processing Records

We maintain records of our data processing activities as required under the UK GDPR, including:

• The purposes of processing
• Categories of personal data processed
• Categories of data subjects
• Recipients of personal data
• Retention periods
• Security measures in place

Third-Party Processing

When we engage third-party processors to handle personal data on our behalf, we ensure:

• Processing only occurs under our written instructions
• Processors maintain appropriate security measures
• Formal data processing agreements are in place
• Processors comply with UK GDPR requirements

International Data Transfers

If we transfer personal data outside the United Kingdom or European Economic Area, we implement appropriate safeguards such as:

• Standard contractual clauses approved by the relevant authorities
• Adequacy decisions confirming the recipient country has adequate data protection
• Binding corporate rules for intra-group transfers

Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

Children's Data

We do not knowingly process personal data of children under 16 years of age. If we become aware that we have collected such data, we will take steps to delete it promptly.

Complaints and Supervisory Authority

If you believe we have not complied with data protection requirements, you can lodge a complaint with:

Information Commissioner's Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Website: ico.org.uk

Helpline: 0303 123 1113

Updates to This Information

We may update this GDPR information periodically to reflect changes in our processing activities or legal requirements. The effective date at the top of this page indicates when it was last revised.