GDPR / Your Data
This page is a first-draft overview of how BrickPixel may handle personal data and how individuals may ask to access, correct or delete information held about them. It is provided as a working framework only and is not legal advice. UK data protection requirements can depend on how a business operates in practice, so the details on this page should be reviewed and completed before publication.
[REVIEW: confirm the legal entity name responsible for BrickPixel and whether this page should refer to UK GDPR, the Data Protection Act 2018, or both.]
1. Introduction
BrickPixel should explain, in clear terms, what personal data it collects, why it collects it, how it uses it, and what choices people have in relation to that data. This page is intended to focus particularly on requests to:
- access personal data,
- correct inaccurate or incomplete personal data, and
- request deletion of personal data where applicable.
[REVIEW: confirm whether this page is intended to be a standalone data rights page or a summary that links to a fuller privacy policy.]
2. Who this page applies to
This information may apply to customers, prospective customers, website users and anyone else whose personal data BrickPixel holds.
[REVIEW: confirm the categories of people whose data BrickPixel processes, for example customers, newsletter subscribers, contact form enquiries, suppliers or job applicants.]
3. What is meant by personal data
For this page, personal data generally means information that can identify a person directly or indirectly. Depending on how BrickPixel operates, this might include names, contact details, account information, order details, correspondence, billing information or technical website data.
[REVIEW: replace this example list with the actual data types BrickPixel collects and uses.]
4. How BrickPixel may collect and use personal data
BrickPixel should set out the main situations in which personal data is collected and used. Typical examples might include:
- when someone contacts BrickPixel,
- when a customer places an order or requests a service,
- when ongoing customer support is provided,
- when records are kept for administrative, accounting or legal reasons, and
- when the website is used.
For each category, BrickPixel should explain the purpose of processing and the lawful basis relied on under UK data protection law, where required.
[REVIEW: add the actual purposes of processing and the lawful bases used, such as contract, legal obligation, consent or legitimate interests, if applicable.]
5. Your rights in relation to your data
Under UK data protection law, individuals may have rights in relation to their personal data. These rights do not apply in exactly the same way in every situation, and BrickPixel should avoid suggesting that every request must always be granted. Subject to applicable law, these rights may include:
- the right to request access to personal data,
- the right to request correction of inaccurate data,
- the right to request erasure in certain circumstances,
- the right to object to or restrict some processing,
- the right to withdraw consent where processing relies on consent, and
- the right to complain to the relevant supervisory authority.
[REVIEW: confirm which rights BrickPixel wishes to explain on this page and whether a separate complaints section should name the Information Commissioner's Office.]
6. How to request access to your personal data
If an individual wants to know what personal data BrickPixel holds about them, they should be able to make a request for access. BrickPixel should explain how a request can be submitted and what information may be needed to help identify the requester and locate the relevant records.
BrickPixel may need to verify identity before disclosing personal data, particularly where the request is sensitive or there is a risk of disclosure to the wrong person.
[REVIEW: add the contact method for access requests, for example a dedicated email address, contact form or postal address.]
[REVIEW: confirm BrickPixel's internal process and expected response timeframe for access requests under UK rules.]
7. How to correct inaccurate information
If personal data held by BrickPixel is inaccurate or incomplete, an individual should be able to ask for it to be corrected. BrickPixel should invite the person to explain what information is wrong and, where appropriate, provide supporting details so records can be updated accurately.
In some cases, BrickPixel may need to retain a limited record of the previous information where there is a lawful reason to do so, for example to maintain an audit trail or comply with legal obligations.
[REVIEW: confirm how correction requests should be submitted and how BrickPixel verifies changes.]
8. How to request deletion of personal data
An individual may ask BrickPixel to delete personal data in certain circumstances. However, deletion is not an automatic right in every case. BrickPixel may need to keep some information where there is an ongoing contractual need, a legal obligation, a legitimate business reason that is lawful, or another valid ground under UK data protection law.
When responding to a deletion request, BrickPixel should explain whether data can be deleted in full, only in part, or not at that time, together with a short explanation where appropriate.
[REVIEW: add BrickPixel's process for handling deletion requests, including any retention exceptions that commonly apply to its records.]
9. Data retention
BrickPixel should explain that personal data is not kept for longer than necessary, while also making clear that different types of information may be retained for different periods depending on purpose and legal requirements.
[REVIEW: add BrickPixel's retention approach or link to a retention schedule if one exists.]
10. Sharing personal data
If BrickPixel shares personal data with service providers, professional advisers, delivery partners, hosting providers or other third parties, this should be described in a clear and accurate way. The explanation should cover the categories of recipients and the reasons for sharing, without overstating what is or is not done.
[REVIEW: add the actual categories of third parties BrickPixel shares data with, if any.]
[REVIEW: confirm whether any personal data is transferred outside the UK and, if so, what safeguards are relied on.]
11. Website and account data
If BrickPixel's website collects technical information, uses cookies, provides customer accounts or stores submitted forms, those activities should be explained consistently across this page and any related privacy or cookie documents.
[REVIEW: add details of any website analytics, account areas, saved preferences, form submissions or related data processing.]
12. Contacting BrickPixel about your data
BrickPixel should provide a clear route for data-related questions and requests. This may be the same contact point used for general privacy enquiries or a dedicated contact for data protection matters.
[REVIEW: add the correct contact details for data protection enquiries.]
13. Changes to this page
BrickPixel may wish to update this page from time to time to reflect changes in its services, internal processes or legal obligations. If so, the page should be reviewed regularly to make sure it remains accurate and consistent with actual practice.
[REVIEW: add a last updated date once the text has been approved.]
14. Final review points before publication
- [REVIEW: confirm all data types actually collected by BrickPixel.]
- [REVIEW: confirm the lawful bases relied on for each processing activity.]
- [REVIEW: confirm request handling times and verification procedures.]
- [REVIEW: confirm retention periods and deletion exceptions.]
- [REVIEW: confirm third-party processors and any international transfers.]
- [REVIEW: confirm the correct contact details and responsible person or team.]
Once these points have been completed and checked against BrickPixel's real processes, this page can be refined into a customer-facing explanation of how people can access, correct or request deletion of their personal data.