GDPR Compliance

Last updated: July 2026

cobalt-vale is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides detailed information about how we handle personal data in accordance with these regulations.

Data Controller

cobalt-vale acts as the data controller for personal information collected through this website and in the course of providing our services. Our contact details are:

cobalt-vale
14 Archway Court
Cheltenham
Gloucestershire GL50 1TH
United Kingdom

Email: [email protected]

Personal Data We Process

In the course of our business, we may process the following categories of personal data:

Client Data

• Contact information: name, address, email, telephone number
• Financial information: payment details, invoicing records
• Project information: research requirements, family details, historical subjects
• Communications: correspondence relating to services

Research Subject Data

Historical research may involve processing personal data about individuals who are the subjects of research, including deceased persons and their living relatives. This may include:

• Names and biographical details
• Family relationships
• Historical records containing personal information

Website Visitor Data

• Technical data: IP address, browser type, device information
• Usage data: pages visited, navigation patterns, time on site
• Enquiry data: information submitted through contact forms

Legal Basis for Processing

We process personal data under the following legal bases as defined in Article 6 of the UK GDPR:

Contract Performance (Article 6(1)(b))

Processing client data necessary to provide requested research services, communicate about projects, and fulfil contractual obligations.

Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate business interests, including:

• Improving our website and services
• Conducting historical research that may be in the public interest
• Maintaining business records
• Protecting our legal rights

Consent (Article 6(1)(a))

Where processing is based on consent, such as marketing communications. You may withdraw consent at any time.

Legal Obligation (Article 6(1)(c))

Processing required to comply with legal requirements, such as financial record-keeping.

Special Category Data

Historical research may occasionally involve special category data (Article 9), such as information about health, religion, or ethnicity found in historical records. We process such data under:

• Archiving purposes in the public interest (Article 9(2)(j))
• Historical research purposes with appropriate safeguards
• Data manifestly made public by the data subject

Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access (Article 15)

You may request a copy of the personal data we hold about you. We will respond within one month of receiving your request.

Right to Rectification (Article 16)

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Article 17)

You may request deletion of your personal data in certain circumstances, including when data is no longer necessary for the purposes collected or when you withdraw consent.

Right to Restriction (Article 18)

You may request that we restrict processing of your data in certain circumstances, such as while we verify accuracy following a challenge.

Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

Right to Object (Article 21)

You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of your rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to valid requests within one month, or inform you if an extension is needed.

We do not charge for most requests, but may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on such requests.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure storage of digital and physical records
• Access controls limiting data access to authorised personnel
• Encrypted communications where appropriate
• Regular review of security practices

Data Retention

We retain personal data only as long as necessary for the purposes collected. Specific retention periods:

• Client project files: 7 years from project completion
• Financial records: 7 years as required by law
• Website analytics: 26 months
• Enquiry records: 2 years if not converted to client relationship

International Transfers

We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

Data Breach Procedures

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours. If the breach poses a high risk, we will also notify affected individuals directly.

Complaints

If you are dissatisfied with how we handle your personal data, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Website: ico.org.uk

Changes to This Information

We may update this GDPR compliance information periodically. Significant changes will be communicated appropriately.