GDPR Compliance

Data Protection Commitment

Serene Robin is committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We recognize the importance of protecting personal data and ensuring transparency in how we process information.

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: You have provided explicit permission for us to process your data for specific purposes
• Contract: Processing is necessary to fulfill our service agreement with you
• Legal Obligation: We are required by law to process certain data in the course of providing legal services
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided this does not override your rights

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data in certain circumstances
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making: Request human review of automated decisions

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected] with your request. We will respond within one month of receiving your request. In complex cases, this may be extended by up to two additional months, and we will inform you accordingly.

Data Security Measures

We implement robust security measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel only
• Staff training on data protection principles
• Secure backup and disaster recovery procedures

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

International Data Transfers

We do not routinely transfer personal data outside the United Kingdom. Should such transfer become necessary, we will ensure appropriate safeguards are in place in accordance with GDPR requirements.

Data Protection Officer

For questions or concerns regarding data protection, you may contact our Data Protection Officer at [email protected].

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, if you believe your data has been processed unlawfully.

ICO Contact Information:
Website: ico.org.uk
Telephone: 0303 123 1113

Last Updated: January 2026