Your data protection rights under UK GDPR
Last Updated: 15 September 2026
The UK General Data Protection Regulation (UK GDPR) is the United Kingdom's data protection framework that came into effect following the UK's departure from the European Union. It works alongside the Data Protection Act 2018 to provide comprehensive protection for personal data processed within the UK.
Comet-lemur is committed to complying with UK GDPR and ensuring that your personal data is handled lawfully, fairly, and transparently.
For the purposes of UK GDPR, Comet-lemur acts as the data controller for personal information collected through our website and consulting services. This means we determine the purposes and means of processing your personal data.
Contact details for data protection enquiries:
Email: [email protected]
Address: 47 Pemberton House, Whitfield Street, London W1T 4HB, United Kingdom
UK GDPR provides you with the following rights regarding your personal data:
You have the right to receive clear, transparent information about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR page.
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. We will respond to rectification requests within one month.
Also known as the "right to be forgotten", you may request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.
You have the right to request that we limit or suspend processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
You have the right to object to processing of your personal data where we are relying on legitimate interests as the legal basis, or where processing is for direct marketing purposes.
You have rights related to automated decision-making and profiling. Comet-lemur does not engage in automated decision-making that produces legal or similarly significant effects on individuals.
To exercise any of your rights under UK GDPR, please contact us using the details above. When submitting a request, please provide:
We may need to verify your identity before processing your request. In most cases, we will respond within one month. If your request is complex or we receive numerous requests, we may extend this period by up to two additional months, and we will inform you of any such extension.
We process personal data under one or more of the following lawful bases:
Where our processing activities are likely to result in a high risk to the rights and freedoms of individuals, we conduct Data Protection Impact Assessments (DPIAs) to identify and minimise data protection risks.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.
If you are not satisfied with our response to a data protection enquiry or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
We may update this GDPR information from time to time to reflect changes in our practices or legal requirements. The date of the most recent revision appears at the top of this page.