GDPR Compliance Statement

Last Updated: July 13, 2026

Our Commitment to Data Protection

crag-cougar is committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection legislation. This statement outlines how we comply with GDPR requirements and respect your data protection rights.

Data Controller Information

For the purposes of data protection legislation, crag-cougar is the data controller responsible for personal data collected through our website and services.

Contact details:
Email: [email protected]
Address: 45 Park Square East, Leeds LS1 2NL, United Kingdom

Personal Data We Process

We process the following categories of personal data:

• Identity data: name, title
• Contact data: email address, postal address
• Service data: property preferences, search requirements, consultation requests
• Communication data: correspondence records, inquiry details
• Technical data: IP address, browser type, device information (collected via cookies)

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: When you voluntarily submit information through forms or provide explicit consent for specific processing activities
• Contract: When processing is necessary to deliver services you have requested or entered into
• Legal obligation: When we must process data to comply with legal requirements
• Legitimate interests: When processing serves our legitimate business interests while respecting your fundamental rights and freedoms

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request access to your personal data and receive information about how we process it. We will provide a copy of your data in a commonly used format.

Right to Rectification

You may request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected or when you withdraw consent.

Right to Restrict Processing

You may request that we restrict processing of your personal data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used format and transmit it to another controller.

Right to Object

You have the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us:

• Email: [email protected]
• Post: Data Protection Officer, crag-cougar, 45 Park Square East, Leeds LS1 2NL, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will notify you of any extension.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data during transmission and storage
• Access controls limiting who can view personal data
• Regular security assessments and vulnerability testing
• Staff training on data protection principles and secure handling practices
• Incident response procedures for data breaches

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected or as required by law. Retention periods vary depending on the type of data and purpose:

• Active client data: Duration of relationship plus six years
• Inquiry data: Two years from last contact
• Marketing consent records: Until consent is withdrawn plus three years
• Financial records: Seven years from end of financial year (legal requirement)

International Data Transfers

Your personal data is primarily processed within the United Kingdom. If we transfer data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

Third-Party Data Sharing

We do not sell personal data to third parties. We may share data with:

• Service providers who process data on our behalf under strict contractual obligations
• Property owners or landlords when necessary to coordinate services you have requested
• Legal or regulatory authorities when required by law

All third-party processors are carefully selected and required to comply with GDPR requirements.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website with an updated revision date.

Contact and Questions

If you have questions about our GDPR compliance or data protection practices, please contact our data protection team:

Email: [email protected]
Post: Data Protection Officer, crag-cougar, 45 Park Square East, Leeds LS1 2NL, United Kingdom

Supervisory Authority

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113