GDPR Compliance Statement
Last updated: September 1, 2026
Our Commitment to GDPR
solar-oak is committed to full compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We recognize the importance of protecting personal data and upholding the rights of individuals whose information we process.
Data Controller Information
For the purposes of data protection legislation, solar-oak acts as the data controller for personal information collected through our website and professional services.
Contact details:
solar-oak
47 Berkeley Square
London W1J 5AT
United Kingdom
Email: [email protected]
Lawful Basis for Processing
We process personal data only when we have a lawful basis under GDPR Article 6:
- Consent (Article 6(1)(a)): You have explicitly agreed to processing for specific purposes, such as receiving communications or participating in educational programmes
- Contract performance (Article 6(1)(b)): Processing is necessary to fulfill our contractual obligations when providing consultation services
- Legal obligation (Article 6(1)(c)): Processing is required to comply with legal requirements, such as tax reporting or professional liability insurance
- Legitimate interests (Article 6(1)(f)): Processing serves our legitimate business interests while respecting your fundamental rights, such as analyzing website usage to improve services
Your Rights Under GDPR
GDPR grants you comprehensive rights regarding your personal data:
Right of Access (Article 15)
You may request confirmation of whether we process your personal data and obtain a copy of that data along with supplementary information about the processing.
Right to Rectification (Article 16)
You can request correction of inaccurate personal data and completion of incomplete data.
Right to Erasure (Article 17)
In certain circumstances, you may request deletion of your personal data, including when data is no longer necessary for the original purpose, when you withdraw consent, or when you successfully object to processing.
Right to Restriction of Processing (Article 18)
You may request that we limit how we use your data in specific situations, such as while we verify data accuracy or assess whether legitimate grounds exist for processing.
Right to Data Portability (Article 20)
Where processing is based on consent or contract performance and carried out by automated means, you can receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to Object (Article 21)
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions based solely on automated processing that produces legal or similarly significant effects. We do not engage in automated decision-making of this nature.
Exercising Your Rights
To exercise any of these rights, please submit a request to [email protected]. We will respond within one month, though this may be extended by two additional months for complex or multiple requests. We will inform you of any extension within the initial month.
We may request additional information to verify your identity before fulfilling requests, particularly for access or deletion requests.
These rights are provided free of charge unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.
Data Protection Principles
We adhere to the GDPR data protection principles, ensuring that personal data is:
- Processed lawfully, fairly, and transparently: We provide clear information about processing activities and obtain appropriate legal basis
- Collected for specified, explicit, legitimate purposes: We clearly define why we collect data and do not use it for incompatible purposes
- Adequate, relevant, and limited: We collect only data necessary for stated purposes
- Accurate and kept up to date: We take reasonable steps to ensure data accuracy and enable corrections
- Retained only as long as necessary: We delete or anonymize data when no longer needed
- Processed securely: We implement appropriate technical and organizational measures to protect data
Data Security Measures
We implement security measures appropriate to the risks presented by our processing activities:
- Encryption of data in transit and at rest
- Access controls limiting data access to authorized personnel
- Regular security assessments and updates
- Staff training on data protection obligations
- Incident response procedures for potential data breaches
Data Breach Notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay. Where the breach poses a high risk, we will notify you directly. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in risk to individuals.
International Data Transfers
When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place as required by GDPR Chapter V. This may include:
- Transfers to countries with adequacy decisions from the European Commission
- Use of Standard Contractual Clauses approved by the European Commission
- Reliance on binding corporate rules or certification mechanisms
Third-Party Processing
When we engage third parties to process personal data on our behalf, we ensure they provide sufficient guarantees regarding data protection. We maintain written contracts with processors that specify processing instructions, security obligations, and other GDPR requirements.
Privacy by Design and Default
We implement data protection principles from the earliest stages of service design and throughout processing activities. We configure services to use the most privacy-friendly settings by default, processing only data necessary for each specific purpose.
Data Protection Impact Assessments
Before undertaking processing operations likely to result in high risk to individuals' rights and freedoms, we conduct Data Protection Impact Assessments to identify and mitigate risks.
Supervisory Authority
You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of alleged infringement.
In the United Kingdom, the relevant supervisory authority is:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Statement
We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Significant updates will be communicated through website notices or direct communication as appropriate.
Questions and Concerns
If you have questions about our GDPR compliance or wish to exercise your data protection rights, please contact us at [email protected]