GDPR Compliance Statement

Last Updated: July 21, 2026

star-kestrel is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This statement outlines how we ensure compliance with GDPR principles when processing your information.

Data Controller

star-kestrel acts as the data controller for any personal information you provide through our website. We determine the purposes and means of processing your personal data.

Contact: [email protected]

Legal Basis for Processing

We process your personal data under the following legal grounds:

  • Consent: When you submit a contact form, you provide explicit consent for us to process your information for the purposes of responding to your inquiry
  • Legitimate Interest: We have a legitimate interest in improving our services and understanding how visitors interact with our website
  • Legal Obligation: We may process data to comply with legal requirements, such as tax and accounting obligations

Your Rights Under GDPR

As a data subject, you have the following rights:

  • Right of Access: You can request a copy of the personal data we hold about you
  • Right to Rectification: You can ask us to correct inaccurate or incomplete data
  • Right to Erasure: You can request deletion of your personal data under certain conditions
  • Right to Restrict Processing: You can ask us to limit how we use your data
  • Right to Data Portability: You can request your data in a structured, machine-readable format
  • Right to Object: You can object to processing based on legitimate interests
  • Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time

How to Exercise Your Rights

To exercise any of these rights, please send a written request to [email protected]. We will respond to your request within one month of receipt. If your request is complex or if we receive multiple requests, we may extend this period by two additional months, and we will inform you accordingly.

Data Protection Principles

We adhere to the following GDPR principles:

  • Lawfulness, Fairness, and Transparency: We process data lawfully and transparently
  • Purpose Limitation: We collect data for specific, explicit, and legitimate purposes
  • Data Minimization: We only collect data that is necessary for our purposes
  • Accuracy: We take reasonable steps to ensure data accuracy
  • Storage Limitation: We retain data only as long as necessary
  • Integrity and Confidentiality: We implement appropriate security measures

Data Transfers

Your personal data is stored and processed within the United Kingdom and European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk to you, we will also notify you directly without undue delay.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.

ICO Website: https://ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised date.

Contact Us

If you have questions about our GDPR compliance or wish to exercise your data rights, please contact us at [email protected].