GDPR & Data Protection

For enquiries, bookings and marketing we are the controller. When we build, host or support systems for a client, we act as a processor and only handle personal data on that client's documented instructions under a data processing agreement.

• Collect the minimum data needed for a clear, stated purpose.
• Keep it accurate and only for as long as it is needed.
• Protect it with access control, encryption in transit and supplier due diligence.
• Build privacy considerations into design and change decisions.

• Access — Ask for a copy of the personal data we hold about you.
• Rectification — Ask us to correct data that is inaccurate or incomplete.
• Erasure — Ask us to delete data where we no longer have a reason to keep it.
• Restriction — Ask us to pause processing while a concern is investigated.
• Portability — Receive data you gave us in a structured, machine-readable format.
• Objection — Object to processing based on our legitimate interests, including marketing.
• Withdraw consent — Withdraw consent at any time where consent is the lawful basis.

Email sales@bluebulbtech.co.uk with the subject "Data protection request", or write to us at 1 Canada Square, 37th Floor, Canary Wharf, London, England, E14 5AA. We respond within one month and may ask for proof of identity first. Requests are free unless they are manifestly unfounded or excessive.

Clients engaging us for delivery or managed services can request a signed data processing agreement, our list of subprocessors, and details of any international transfer safeguards we rely on.

We investigate suspected personal data breaches immediately and notify affected controllers or individuals and the ICO where the law requires. If you are unhappy with how we handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Related pages: Privacy Policy and Cookie Policy.