GDPR Compliance

Last updated: June 2026

Our Commitment to Data Protection

hollow-puma is committed to compliance with the General Data Protection Regulation and UK data protection legislation. This document outlines our approach to protecting personal data and the rights available to individuals whose information we process.

Data Controller Information

For the purposes of data protection legislation, hollow-puma acts as data controller for personal information collected through our website and during service delivery.

Contact details:
hollow-puma
Clifton Quarter
Bristol BS8 4DP
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis under GDPR Article 6:

Contract Performance

Processing necessary to perform our consultancy services agreement with you, including property search activities, communication regarding opportunities, and transaction support.

Legitimate Interests

Processing necessary for our legitimate business interests, including responding to enquiries, improving service quality, and maintaining business records. We have assessed these interests against your rights and implemented appropriate safeguards.

Legal Compliance

Processing required to comply with legal obligations, including financial record-keeping requirements and professional conduct standards.

Consent

Processing based on your explicit consent for specific purposes, such as marketing communications or particular uses of information. Consent may be withdrawn at any time without affecting other processing activities.

Your Data Protection Rights

Right of Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a commonly used electronic format unless another format is requested.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete information. We will assess requests and make appropriate amendments where justified.

Right to Erasure

You may request deletion of personal data in certain circumstances, including when data is no longer necessary for original purposes, consent is withdrawn, or processing lacks lawful basis. This right is not absolute and may be limited by legal retention requirements or other legitimate grounds.

Right to Restriction

You may request restriction of processing while disputes regarding accuracy or lawfulness are resolved, or when you object to processing but we need to verify whether legitimate grounds override your interests.

Right to Data Portability

Where processing is based on consent or contract performance and carried out by automated means, you may request transfer of personal data to another controller in a structured, commonly used format.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.

Rights Related to Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts. All substantive decisions regarding service delivery involve human assessment.

Exercising Your Rights

To exercise any of these rights, submit a request to [email protected]. Please include:

• Your full name and contact details
• Specification of which right you wish to exercise
• Details of the information or processing concerned
• Verification information to confirm your identity

We will respond within one month of receipt. Complex requests may require up to three months, in which case we will notify you of the extension and reasons.

Data Processing Principles

Our data processing adheres to GDPR principles:

Lawfulness, Fairness, and Transparency

We process data lawfully under identified legal bases and provide clear information about processing activities.

Purpose Limitation

Personal data is collected for specified, explicit purposes and not processed in ways incompatible with those purposes.

Data Minimization

We collect only data adequate, relevant, and necessary for identified purposes.

Accuracy

We take reasonable steps to ensure personal data is accurate and kept up to date. Inaccurate data is corrected or deleted promptly.

Storage Limitation

Personal data is retained only for as long as necessary for processing purposes, except where longer retention is required by law.

Integrity and Confidentiality

We implement appropriate security measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

Accountability

We maintain documentation demonstrating compliance with data protection principles and are prepared to demonstrate such compliance to supervisory authorities.

Data Security Measures

Technical and organizational security measures include:

• Encryption of data in transit and at rest
• Access controls restricting data to authorized personnel
• Regular security assessments and penetration testing
• Staff training on data protection obligations
• Incident response procedures for data breaches
• Vendor assessment procedures for third-party processors

Data Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify you without undue delay. High-risk breaches will be reported to the Information Commissioner's Office within 72 hours of awareness.

International Data Transfers

Personal data is primarily processed within the United Kingdom. Any international transfers are conducted through approved mechanisms ensuring adequate protection, including standard contractual clauses or transfers to countries with adequacy decisions.

Third-Party Processing

Third parties processing personal data on our behalf are bound by data processing agreements ensuring GDPR compliance. We conduct due diligence before engaging processors and monitor their compliance throughout the relationship.

Complaints and Supervisory Authority

If you believe our processing violates data protection law, you may lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

Policy Updates

This GDPR compliance document may be updated to reflect regulatory changes or modifications to our processing activities. Material changes will be communicated through website notice or direct notification to active clients.