GDPR Compliance

Last updated: September 2026

Our Commitment to Data Protection

dapper-leaf is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we fulfil our obligations as a data controller and how you can exercise your rights.

Data Controller Information

dapper-leaf acts as the data controller for personal information collected through this website and our services.

Contact for data protection matters:

Email: [email protected]

Address: Suite 412, Spinningfields House, Hardman Square, Manchester M3 3EB

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent (Article 6(1)(a)): When you voluntarily submit information through our forms
• Contract (Article 6(1)(b)): When processing is necessary to perform services you have requested
• Legitimate Interests (Article 6(1)(f)): For business operations, security, and service improvement where your interests are not overridden

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15)

You may request a copy of the personal data we hold about you. We will respond within one month of receiving your request.

Right to Rectification (Article 16)

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Article 17)

You may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose.

Right to Restriction (Article 18)

You may request restriction of processing in certain circumstances, such as when you contest the accuracy of your data.

Right to Data Portability (Article 20)

You may request transfer of your personal data in a structured, commonly used format.

Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes.

Exercising Your Rights

To exercise any of these rights, please contact us using the details above. We will:

• Verify your identity before processing requests
• Respond within one month (extendable by two months for complex requests)
• Provide information free of charge in most cases
• Explain any reasons for declining requests

Data Processing Records

We maintain records of our processing activities as required by Article 30 of the UK GDPR, including:

• Categories of data processed
• Purposes of processing
• Recipients of data
• Retention periods
• Security measures implemented

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments when processing is likely to result in high risk to individuals' rights and freedoms.

Data Breach Procedures

We have procedures in place to detect, investigate, and report personal data breaches. Where required, we will notify the Information Commissioner's Office within 72 hours and affected individuals without undue delay.

International Data Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

Supervisory Authority

If you are unsatisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:

Website: ico.org.uk

Helpline: 0303 123 1113

Updates to This Information

We review our data protection practices regularly and may update this page accordingly. Significant changes will be communicated through appropriate channels.