GDPR Compliance Statement

Last updated: September 1, 2026

Our Commitment to Data Protection

keen-lagoon is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller Information

keen-lagoon Energy Consulting acts as the data controller for personal information collected through this website and our services.

Contact details:
keen-lagoon Energy Consulting
42 Mill Lane
Bradford, West Yorkshire, BD1 4SG
United Kingdom
Email: [email protected]

Types of Personal Data We Process

Data Type Purpose Legal Basis
Name and contact details To respond to enquiries and provide services Contractual necessity, legitimate interest
Company information To understand business context and tailor services Legitimate interest
Project details To assess requirements and provide appropriate consulting Contractual necessity
Website usage data To improve website functionality and user experience Legitimate interest, consent (for cookies)
Email preferences To manage communication preferences Consent

Your Rights Under GDPR

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of your request, free of charge.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction.

Right to Erasure

You can request deletion of your personal data when:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent and there is no other legal basis for processing
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to Object

You can object to processing of your personal data where we rely on legitimate interests as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with the subject line "GDPR Request". Please include:

  • Your full name and contact details
  • Details of your specific request
  • Proof of identity (if required for security purposes)

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of any delay.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of personal data in transit and at rest
  • Regular security assessments and updates
  • Access controls limiting data access to authorized personnel only
  • Staff training on data protection responsibilities
  • Secure backup and recovery procedures

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Enquiry data: 3 years from last contact
  • Client project data: 7 years after project completion (for professional indemnity purposes)
  • Marketing consent data: Until consent is withdrawn
  • Website analytics: 26 months

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place through:

  • Adequacy decisions
  • Standard contractual clauses
  • Binding corporate rules

Third-Party Processors

We work with carefully selected third-party service providers who process data on our behalf. All processors are bound by data processing agreements that require GDPR compliance and appropriate security measures.

Children's Data

Our services are not directed at children under 18. We do not knowingly collect or process personal data from children.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised date.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office if you believe we have not complied with data protection law:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Contact Us

For questions about our data protection practices or to exercise your rights, contact us at [email protected].