GDPR Compliance Statement

Last updated: June 19, 2026

Our Commitment to Data Protection

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

This statement explains how we comply with these regulations and safeguard your information.

Data Controller

For the purposes of GDPR, the data controller is Sparkira Vacuum, with registered address at 47 Kensington Park Road, Notting Hill, London W11 2EU, United Kingdom.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contractual necessity: to provide energy assessment services you have requested
• Legitimate interests: to respond to enquiries and maintain business records
• Legal obligation: to comply with professional standards and regulatory requirements
• Consent: where you have explicitly agreed to specific processing activities

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: obtain confirmation of whether we process your data and request a copy
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data in certain circumstances
• Right to restriction: request limitation of processing under specific conditions
• Right to data portability: receive your data in a structured, commonly used format
• Right to object: object to processing based on legitimate interests
• Rights related to automated decision-making: we do not use automated decision-making or profiling

Exercising Your Rights

To exercise any of your rights under GDPR, please submit a written request to [email protected].

We will respond to your request within one month of receipt.

We may require proof of identity before processing your request to ensure data security.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected.

Client records and assessment reports are retained for seven years in accordance with professional standards.

Website enquiry data not resulting in service provision is typically deleted after two years.

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

These measures include encryption, access controls, secure storage systems, and regular security assessments.

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom or European Economic Area.

Should such transfer become necessary, we will ensure appropriate safeguards are in place as required by GDPR.

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay.

We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

Supervisory Authority

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

ICO contact details can be found at ico.org.uk.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements.

Significant changes will be communicated through our website.