GDPR Compliance

Last Updated: September 2026

General Data Protection Regulation

We are committed to protecting your personal data in accordance with the General Data Protection Regulation and the Data Protection Act 2018.

Data Controller

For the purposes of data protection legislation, the data controller is:

snug-flow
47 Cavendish Road
Bristol, BS8 4NE
United Kingdom

Email: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Consent: You have given explicit consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract with you or to take steps prior to entering into a contract
• Legal obligation: Processing is necessary to comply with legal requirements
• Legitimate interests: Processing is necessary for our legitimate business interests, provided this does not override your rights

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data in certain circumstances.

Right to Restrict Processing

You can request that we limit how we use your personal data.

Right to Data Portability

You can request a copy of your personal data in a structured, commonly used format.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of your rights under GDPR, send a written request to [email protected]. We will respond to your request within one month.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Service inquiry data: Retained for the duration of the project plus six years for legal purposes
• Website analytics data: Retained for 24 months
• Cookie consent records: Retained for 12 months

Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

International Data Transfers

Your personal data is processed and stored within the United Kingdom. We do not transfer personal data outside the UK or European Economic Area.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Website: ico.org.uk

Updates to This Notice

We may update this GDPR compliance notice periodically. Changes will be posted on this page with a revised date.