GDPR Compliance

Last updated: June 14, 2026

Our Commitment to GDPR

russet-dune is committed to complying with the General Data Protection Regulation and protecting the personal data of all individuals who interact with our services. This document outlines how we ensure compliance with GDPR requirements.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you submit information through our contact forms, you provide explicit consent for us to process your data to respond to your inquiry
• Legitimate interests: We process data to improve our services and website functionality, ensuring these interests do not override your fundamental rights and freedoms
• Contractual necessity: When you engage our services, we process data necessary to fulfill our contractual obligations

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request a copy of the personal information we hold about you. We will provide this information in a commonly used electronic format within one month of your request.

Right to Rectification

If you believe any information we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it.

Right to Erasure

You have the right to request deletion of your personal data when there is no compelling reason for its continued processing, subject to certain legal exceptions.

Right to Restrict Processing

You can request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data or object to our processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data where we are relying on legitimate interests as the legal basis for processing.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data during transmission and storage
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection principles
• Procedures for detecting, reporting, and investigating data breaches

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Retention periods vary depending on the nature of the data and the purpose for processing.

International Data Transfers

Any transfer of personal data outside the European Economic Area will be done in accordance with GDPR requirements, ensuring appropriate safeguards are in place to protect your information.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us at [email protected]. We will respond to your request within one month. In complex cases, this period may be extended by two additional months, and we will inform you of any such extension.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection issues.

Updates to This Statement

We may update this GDPR compliance statement periodically to reflect changes in our practices or legal requirements. The date of the latest revision will always be indicated at the top of this page.