DATA PROTECTION

We take the protection of personal data seriously. Whether we hold data about a visitor, a partner, a client or a member of our team, we handle it in line with the UK General Data Protection Regulation and the Data Protection Act 2018, and we expect the same standard from everyone who works with us.

For personal data collected through this website and through our own communications, Somber Group is the controller: we decide why the data is held and how it is used.

Where we provide services that involve handling personal data on behalf of a brand, client or partner, we act as a processor and use that data only on their documented instructions. In those cases, their privacy notice applies to you, and we refer any request you make to them.

• Lawfulness, fairness and transparency: we have a lawful basis for processing and we tell people what we do with their data.
• Purpose limitation: data is collected for specified, explicit purposes and not used for anything incompatible with them.
• Data minimisation: we collect only what is needed for the purpose.
• Accuracy: we take reasonable steps to keep data accurate and up to date.
• Storage limitation: we keep data only for as long as it is needed.
• Integrity and confidentiality: data is protected against unauthorised or unlawful use, loss or damage.
• Accountability: we can show how we meet these principles, and we keep records to prove it.

• Legitimate interests: responding to business enquiries, operating and securing the website, and promoting the group and its brands. We balance these interests against your rights and freedoms.
• Consent: sending marketing communications, where you have opted in. You can withdraw consent at any time.
• Contract: where we need to take steps to enter into, or perform, a contract with you.
• Legal obligation: records we are required to keep by law.

• the right to be informed about how your data is used;
• the right of access to the personal data we hold about you;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure, where there is no good reason for us to keep it;
• the right to restrict processing, so that data is stored but not used;
• the right to data portability, to receive your data in a structured, commonly used format;
• the right to object to processing based on legitimate interests, and to direct marketing at any time;
• the right to withdraw consent at any time, where consent is the basis for processing;
• rights relating to automated decisions: we do not make decisions about people by automated means alone.

Write to hello@sombergroup.com and tell us what you would like us to do. We respond within one month, and we will let you know if a request is complex and needs longer. We may ask for proof of identity before acting, so that we do not disclose data to the wrong person. Requests are free of charge, although we may charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive.

The measures we apply are proportionate to the risk. They include:

• encryption of personal data in transit across public networks;
• access limited to the people who need it, on a least-privilege basis, and reviewed regularly;
• written agreements with suppliers that handle personal data on our behalf, requiring confidentiality and appropriate security;
• prompt identification, investigation and remediation of security incidents, with clear internal reporting;
• secure deletion or anonymisation of data once there is no longer a reason to hold it.

If a breach occurs, we investigate it immediately, contain it and assess the risk to the people affected. Where a breach is likely to result in a risk to their rights and freedoms, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Where there is a high risk, we also tell the individuals affected without undue delay.

We keep personal data only for as long as we need it for the purpose it was collected, for any period we are required to keep it by law, and for as long as is necessary to deal with a complaint or claim. We maintain records of our processing activities so that we can demonstrate accountability, and we review retention periods periodically.

Where personal data is transferred outside the UK or the European Economic Area, we ensure an appropriate safeguard is in place, such as UK adequacy regulations, the International Data Transfer Agreement or the standard contractual clauses, supported by a transfer risk assessment.

Everyone who handles personal data is made aware of their responsibilities through internal guidance and training. We review our policies and procedures regularly, monitor changes in the law and in practice, and adjust what we do as a result.

Please contact us first at hello@sombergroup.com so we can put things right. If you remain unhappy, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your country of residence.