GDPR Compliance Statement

Last updated: October 13, 2026

Our Commitment to Data Protection

Qevlaniro-advisory is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognize the importance of protecting your personal data and maintaining transparency about our data processing activities.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

Qevlaniro-advisory
47 Bedford Square
Bloomsbury
London WC1B 3DP
United Kingdom

Email contact: [email protected]

What Personal Data We Process

We process the following categories of personal data:

Identity Data

• Full name
• Contact details (email address)

Technical Data

• IP address
• Browser type and version
• Device information
• Operating system

Usage Data

• Pages visited on our website
• Time spent on pages
• Referral sources
• Navigation patterns

Communication Data

• Enquiry form submissions
• Email correspondence
• Service preferences

Lawful Bases for Processing

We process personal data only when we have a lawful basis to do so under Article 6 of UK GDPR:

Consent (Article 6(1)(a))

When you voluntarily submit information through our enquiry forms, you provide explicit consent for us to process that data for the stated purposes.

Legitimate Interests (Article 6(1)(f))

We process certain data based on our legitimate business interests, including:

• Responding to enquiries about our services
• Improving website functionality and user experience
• Detecting and preventing fraud or security threats
• Operating and protecting our business

We balance these interests against your rights and only process data when our interests do not override your fundamental rights and freedoms.

Legal Obligation (Article 6(1)(c))

In certain circumstances, we process data to comply with legal requirements, such as responding to lawful requests from authorities or maintaining records required by law.

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access (Article 15)

You may request confirmation of whether we process your personal data and obtain a copy of that data along with supplementary information about our processing activities.

Right to Rectification (Article 16)

You may request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure (Article 17)

You may request deletion of your personal data under certain circumstances, including when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing (Article 18)

You may request that we limit how we use your data in certain situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, you may request to receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

Right to Object (Article 21)

You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Rights Related to Automated Decision-Making (Article 22)

We do not make decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

How to Exercise Your Rights

To exercise any of your data protection rights, send a request to [email protected]

We will respond to verified requests within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension and reasons for the delay.

You will not normally have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Our standard retention periods are:

• Enquiry data: 3 years from last contact
• Website usage data: 13 months
• Email correspondence: 3 years from last communication

After these periods, data is securely deleted or anonymized.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Staff training on data protection principles
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. If the breach poses a high risk, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach.

International Data Transfers

We primarily store and process data within the United Kingdom and European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules for group companies

Third-Party Processing

We may engage third-party service providers to process data on our behalf. These processors are contractually bound to:

• Process data only on our documented instructions
• Implement appropriate security measures
• Maintain confidentiality
• Assist with fulfilling data subject rights
• Delete or return data upon termination of services

Children's Data

Our services are not directed at children under 18 years of age. We do not knowingly collect or process personal data from children. If you become aware that a child has provided us with personal data, contact us immediately so we can delete it.

Accountability and Governance

We maintain internal records of processing activities and regularly review our data protection practices to ensure continued compliance with GDPR requirements. We conduct Data Protection Impact Assessments (DPIAs) for processing activities that present high risks to individuals' rights and freedoms.

Right to Lodge a Complaint

If you believe we have not processed your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. In the UK, the supervisory authority is:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Website: ico.org.uk
Telephone: 0303 123 1113

Updates to This Statement

We may update this GDPR compliance statement periodically to reflect changes in our processing activities or legal requirements. Material changes will be communicated through our website.

Contact Us

For questions about our GDPR compliance or to exercise your data protection rights, contact us at:

Email: [email protected]
Address: 47 Bedford Square, Bloomsbury, London WC1B 3DP, United Kingdom