GDPR Compliance

Data Controller Information

neo-spring operates as the data controller for personal information collected through our property advisory services. We are responsible for determining how your personal data is processed and for ensuring compliance with applicable data protection laws.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: Processing required to provide services you have requested
• Legitimate Interests: Processing necessary for our business operations, provided such interests do not override your rights
• Legal Obligation: Processing required to comply with legal requirements
• Consent: Where you have provided explicit consent for specific processing activities

Your GDPR Rights

Right of Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a commonly used electronic format within one month of your request.

Right to Rectification

If personal information we hold is inaccurate or incomplete, you have the right to request correction. We will update records promptly upon verification of accuracy.

Right to Erasure

Under certain circumstances, you may request deletion of your personal data. This right applies when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and no other legal basis exists for processing
• You object to processing and no overriding legitimate grounds exist
• Data has been unlawfully processed
• Erasure is required to comply with legal obligations

This right is subject to exceptions, including legal retention requirements and legitimate business needs.

Right to Restriction of Processing

You may request limitation of how we use your personal data when:

• You contest the accuracy of the data, during verification
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing, pending verification of legitimate grounds

Right to Data Portability

For data you have provided based on consent or contractual necessity, you may request transfer to another service provider in a structured, commonly used format where technically feasible.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not employ automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Exercising Your Rights

To exercise any of these rights, submit a request to [email protected] with:

• Clear identification of the right you wish to exercise
• Sufficient information to verify your identity
• Specific details about the data or processing in question

We respond to valid requests within one month, with possible extension to two months for complex requests. No fee is charged unless requests are manifestly unfounded or excessive.

Data Protection Officer

Inquiries regarding data protection practices should be directed to [email protected]. Our data protection procedures are reviewed regularly to ensure ongoing compliance with GDPR requirements.

Complaints

If you believe our data processing practices violate GDPR provisions, you may lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk

International Data Transfers

Your personal data is processed and stored within the United Kingdom. If international transfer becomes necessary, we ensure appropriate safeguards are in place through standard contractual clauses or other legally approved mechanisms.

Data Security Measures

We implement technical and organizational measures appropriate to the risks associated with personal data processing, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Restricted access controls and authentication requirements
• Staff training on data protection responsibilities
• Incident response procedures for potential data breaches

Data Breach Notification

In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay, providing information about the nature of the breach and measures taken to address it.