Our commitment to data protection compliance
Last updated: 1 September 2026
pebble-verse Ltd is committed to protecting the personal data of all individuals who interact with our organisation. We comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ensuring that personal data is processed lawfully, fairly, and transparently.
For the purposes of UK data protection legislation, the data controller is:
pebble-verse Ltd
47 Chancery Lane
London WC2A 1EN
United Kingdom
Email: [email protected]
In accordance with UK GDPR, we adhere to the following data protection principles:
We process personal data only where we have a valid legal basis and ensure that individuals are informed about how their data will be used through clear privacy notices and this GDPR statement.
Personal data is collected for specified, explicit, and legitimate purposes. We do not process data in ways that are incompatible with those purposes without obtaining fresh consent or establishing a new lawful basis.
We collect only the personal data that is necessary for the purposes for which it is processed. We regularly review our data collection practices to ensure we are not gathering excessive information.
We take reasonable steps to ensure that personal data is accurate and kept up to date. We have procedures in place for individuals to correct inaccurate data and for regular data quality reviews.
Personal data is kept in a form that permits identification for no longer than necessary. We have retention schedules in place and securely dispose of data that is no longer required.
We implement appropriate technical and organisational measures to ensure the security of personal data, protecting against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
We maintain records of our processing activities and can demonstrate compliance with UK GDPR requirements. Our staff receive appropriate training on data protection obligations.
As a data subject, you have the following rights regarding your personal data:
You have the right to obtain confirmation of whether we process your personal data and to request a copy of that data. We will respond to access requests within one month.
If personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will make corrections promptly upon verification of the correct information.
In certain circumstances, you have the right to request deletion of your personal data. This right applies where the data is no longer necessary, where consent is withdrawn, or where processing was unlawful.
You may request that we restrict processing of your personal data in certain circumstances, such as while we verify accuracy or consider an objection to processing.
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.
You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making in our services.
To exercise any of your data protection rights, please contact us using the details above. We will respond to your request within one month. In complex cases or where we receive numerous requests, we may extend this period by a further two months, but we will inform you of any extension within the first month.
We may need to verify your identity before processing your request. There is generally no fee for exercising your rights, though we may charge a reasonable fee for manifestly unfounded or excessive requests.
We have procedures in place to detect, investigate, and report personal data breaches. Where a breach is likely to result in a risk to individual rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. Where there is a high risk to individuals, we will also notify affected persons directly.
Personal data is primarily processed and stored within the United Kingdom. If we transfer personal data outside the UK, we ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other approved transfer mechanisms under UK GDPR.
If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.
We review this GDPR statement periodically and update it as necessary to reflect changes in our practices or legal requirements. The date at the top of this page indicates when it was last revised.