GDPR Compliance Information

Last updated: November 13, 2026

Our Commitment to Data Protection

Diplaammel is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page provides information about your data protection rights and how we comply with GDPR requirements.

Data Controller Information

For the purposes of GDPR, the data controller is:

Diplaammel
47 Clerkenwell Road
London EC1M 5RS
United Kingdom
Email: [email protected]

Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. We will respond to your request within one month.

Right to Rectification

You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

Right to Erasure

You have the right to request that we erase your personal data under certain conditions, including:

  • The data is no longer necessary for the purposes for which it was collected
  • You withdraw your consent and there is no other legal basis for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed
  • The data must be erased to comply with a legal obligation

Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data under certain conditions:

  • You contest the accuracy of the data
  • Processing is unlawful but you do not want the data erased
  • We no longer need the data but you require it for legal claims
  • You have objected to processing pending verification of legitimate grounds

Right to Object

You have the right to object to our processing of your personal data where we are relying on legitimate interests and there is something about your particular situation that makes you want to object. You also have the right to object to processing for direct marketing purposes.

Right to Data Portability

You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

Right to Withdraw Consent

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at [email protected]. Please include:

  • Your full name and contact information
  • Details of your specific request
  • Any relevant reference numbers (booking references, etc.)
  • Proof of identity if required

We will respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made multiple requests, in which case we will notify you and keep you updated.

Legal Basis for Processing

We process your personal data under the following legal bases:

  • Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
  • Legal obligation: Processing is necessary for compliance with legal obligations
  • Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your rights
  • Consent: You have given clear consent for us to process your personal data for specific purposes

Data Security

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Regular security assessments and updates
  • Access controls limiting who can access personal data
  • Staff training on data protection obligations
  • Incident response procedures for data breaches

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible.

International Data Transfers

We do not transfer your personal data outside the United Kingdom or European Economic Area. If this changes in the future, we will ensure appropriate safeguards are in place and update this policy accordingly.

Automated Decision-Making and Profiling

We do not use automated decision-making or profiling in our processing of your personal data.

Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can delete such information.

Complaints

If you wish to raise a complaint about how we have handled your personal data, please contact us at [email protected] and we will investigate the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically for the latest information on our data protection practices.