GDPR Compliance

Last Updated: September 2026

Our Commitment to Data Protection

brisk-stoat is committed to compliance with the UK General Data Protection Regulation and Data Protection Act 2018. We process personal data lawfully, fairly, and transparently.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you submit inquiry forms, you consent to us processing your information to respond to your request.
• Contractual Necessity: When providing consulting services, processing personal data is necessary for contract performance.
• Legitimate Interests: We may process data where necessary for our legitimate business interests, provided this does not override your rights.

Data Subject Rights

Under UK GDPR, you have the following rights:

• Right to Access: Request copies of your personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data in certain circumstances.
• Right to Restrict Processing: Request limitation on how we use your data.
• Right to Data Portability: Request transfer of your data to another organisation.
• Right to Object: Object to processing based on legitimate interests.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected] with your request. We will respond within one month, though complex requests may require up to three months with advance notice.

We may need to verify your identity before fulfilling requests to ensure data security.

Data Processing Activities

We process personal data for the following purposes:

• Responding to service inquiries and consultation requests
• Delivering contracted environmental consulting services
• Maintaining client records and project documentation
• Improving website functionality and user experience

Data Sharing

Personal data may be shared with:

• Service providers who assist with website hosting and technical infrastructure
• Professional partners involved in specific project delivery (with client consent)
• Regulatory authorities where legally required

We do not sell personal data to third parties.

International Data Transfers

Personal data is primarily stored and processed within the United Kingdom. Any transfers outside the UK will be protected by appropriate safeguards as required by UK GDPR.

Data Breach Notification

In the event of a data breach likely to result in risk to your rights, we will notify affected individuals within 72 hours of becoming aware of the breach, as required by regulation.

Complaints

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority.

ICO contact: ico.org.uk

Contact Our Data Protection Officer

For questions about data protection or to exercise your rights, contact [email protected].