Last updated: 30 September 2026
gracefjord is committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This document outlines our approach to data protection and your rights as a data subject.
For the purposes of data protection legislation, gracefjord acts as the data controller for personal information collected through our website and business operations.
Contact details:
gracefjord
17 Ecclesall Road South
Sheffield, S11 9PG
United Kingdom
Email: [email protected]
We process personal data only when we have a lawful basis to do so:
You have the following rights regarding your personal data:
You may request confirmation of whether we process your personal data and obtain a copy of such data. We will respond to access requests within one month.
You may request correction of inaccurate personal data or completion of incomplete information.
You may request deletion of your personal data where there is no compelling reason for its continued processing, subject to legal retention obligations.
You may request limitation on how we process your data in certain circumstances, such as when you contest the accuracy of the data.
You may request transfer of your personal data to another controller in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts.
To exercise any of these rights, submit a written request to [email protected]. We may require verification of your identity before processing requests. There is no fee for exercising these rights unless requests are manifestly unfounded or excessive.
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach.
Personal data is primarily processed within the United Kingdom. If data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods vary depending on the nature of the data and the purpose of processing.
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such information, contact us immediately for deletion.
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates data protection law. In the UK, the relevant authority is:
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
We may update this GDPR compliance information periodically. Significant changes will be communicated through our website. The date of the latest revision is indicated at the top of this document.
For questions about GDPR compliance or to exercise your rights, contact us at [email protected]