GDPR Compliance Information

Last Updated: June 2026

Our Commitment to Data Protection

wind-kernel is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides specific information about our GDPR compliance practices and your rights under these regulations.

Data Controller Information

For the purposes of UK GDPR, wind-kernel is the data controller responsible for your personal information.

Contact Details:
wind-kernel
47 Wellington Street
Leeds, West Yorkshire LS1 4JE
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so under UK GDPR. Our processing activities are based on:

Consent (Article 6(1)(a))

When you provide explicit consent for us to process your personal data for specific purposes, such as marketing communications or certain optional service features.

Contract Performance (Article 6(1)(b))

Processing necessary to fulfill our contractual obligations when delivering financial management services you have requested.

Legal Obligation (Article 6(1)(c))

Processing required to comply with UK financial services regulations, anti-money laundering laws, and other legal requirements.

Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate business interests, such as improving our services, preventing fraud, and maintaining business records, provided these interests do not override your fundamental rights and freedoms.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15)

You can request confirmation of whether we process your personal data and obtain a copy of that data along with supplementary information about how we use it.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete information we hold about you.

Right to Erasure (Article 17)

In certain circumstances, you can request deletion of your personal data, including when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

This right is not absolute and may be limited by our legal obligations to retain certain records.

Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability (Article 20)

Where technically feasible, you can request to receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another data controller.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making systems in our service delivery.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

How to Exercise Your Rights

To exercise any of your rights under UK GDPR, please contact us at [email protected] with the following information:

• Your full name and contact details
• Clear description of which right you wish to exercise
• Specific information about the data concerned (if applicable)
• Proof of identity to prevent unauthorized disclosure

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of such extension within the initial month.

Data Processing Activities

Categories of Personal Data We Process

• Identity data including name and contact information
• Financial data relevant to services provided
• Transaction data related to service delivery
• Technical data from website usage
• Communication data from our correspondence

Recipients of Personal Data

We may share your data with:

• Service providers who assist in delivering our services
• Professional advisors including lawyers and accountants
• Regulatory authorities when legally required
• IT service providers who support our systems

International Transfers

We primarily process and store data within the United Kingdom. If we transfer your data internationally, we ensure adequate safeguards are in place through:

• Standard contractual clauses approved by UK authorities
• Adequacy decisions recognizing equivalent data protection standards
• Other appropriate safeguards as required by UK GDPR

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security commensurate with the risk to your rights and freedoms, including:

• Encryption of data in transit and at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Staff training on data protection obligations
• Incident response procedures for data breaches

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected or as required by law. Our standard retention periods are:

• Client service records: Seven years after service completion
• Financial transaction records: Seven years as required by UK financial regulations
• Marketing consent records: Until consent is withdrawn
• Website analytics data: 26 months from collection

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by UK GDPR.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that pose high risks to your rights and freedoms, documenting the risks and mitigation measures implemented.

Complaints and Supervisory Authority

If you have concerns about how we handle your personal data, please contact us first so we can address your concerns. If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website and, where appropriate, directly to affected individuals.

Additional Resources

For more information about our general privacy practices, please see our Privacy Policy. For cookie-specific information, refer to our Cookies Policy.