GDPR Compliance Statement

Last updated: 8 September 2026

Our commitment

OnyxCliff is committed to compliance with the UK General Data Protection Regulation and the Data Protection Act 2018. We respect the rights of individuals and process personal data in accordance with applicable data protection legislation.

Data controller

OnyxCliff acts as the data controller for personal information collected through this website and in the course of providing consulting services.

Lawful basis for processing

We process personal data under the following lawful bases:

• Consent: when you provide explicit consent for specific processing activities
• Contract: when processing is necessary to perform a contract with you
• Legal obligation: when we must process data to comply with the law
• Legitimate interests: when processing is necessary for our legitimate business interests, balanced against your rights

Your rights under GDPR

You have the following rights regarding your personal data:

Right of access

You have the right to request a copy of the personal data we hold about you.

Right to rectification

You can request correction of inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you may request deletion of your personal data.

Right to restrict processing

You can ask us to limit how we use your personal data in specific situations.

Right to data portability

You have the right to receive your data in a structured, machine-readable format.

Right to object

You may object to processing based on legitimate interests or for direct marketing purposes.

Rights related to automated decision-making

You have rights regarding automated decisions that significantly affect you. We do not currently use automated decision-making processes.

How to exercise your rights

To exercise any of these rights, contact us at [email protected]. We will respond to requests within one month. If your request is complex, we may extend this period by two additional months and will inform you accordingly.

Data protection officer

For data protection enquiries, you may contact our designated representative at [email protected].

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO contact details:
Website: ico.org.uk
Helpline: 0303 123 1113

International transfers

We do not routinely transfer personal data outside the United Kingdom. If such transfers become necessary, we will ensure appropriate safeguards are in place as required by UK GDPR.

Data security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments.

Data breach notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.