GDPR Compliance

Legal Basis for Processing

We process personal data under the following legal bases established by GDPR:

Contract Performance: When you request fuel advisory services, we process information necessary to fulfill our contractual obligations, including consultation delivery and report preparation.

Legitimate Interests: We process certain data to improve our services, maintain website security, and conduct business operations, provided this processing does not override your fundamental rights.

Consent: For marketing communications and non-essential cookies, we rely on your explicit consent, which you may withdraw at any time.

Your Data Protection Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You may request copies of your personal data. We will provide this information in a commonly used electronic format within one month of your request.

Right to Rectification

You may request correction of inaccurate or incomplete personal data. We will update our records promptly upon verification of the corrections.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes collected, you withdraw consent, or you object to processing. This right is subject to legal retention obligations.

Right to Restrict Processing

You may request limitation of data processing while we verify accuracy, assess legitimate grounds for processing, or when you need data preserved for legal claims.

Right to Data Portability

You may request transfer of data you provided to us in a structured, machine-readable format, either to yourself or to another service provider where technically feasible.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. All service recommendations result from human analysis.

Data Controller Information

The data controller responsible for your personal information is valley-starling, located at 67 Bold Street, Liverpool L1 4EZ, United Kingdom.

For data protection inquiries, contact [email protected].

Data Processing Activities

We process the following categories of personal data:

• Identity data including name and contact details
• Vehicle information including make, model, and usage patterns
• Fuel consumption records and journey logs
• Technical data from website visits including IP addresses and browser information
• Communication preferences and service requests

International Data Transfers

Your personal data is processed and stored within the United Kingdom. We do not transfer data outside the UK or European Economic Area except when necessary for service delivery using providers who comply with GDPR through appropriate safeguards.

Data Security Measures

We implement technical and organizational measures to protect personal data against unauthorized access, accidental loss, or destruction. These measures include:

• Encrypted data transmission using secure protocols
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Staff training on data protection obligations

Data Breach Notification

In the event of a data breach likely to result in high risk to your rights and freedoms, we will notify you within seventy-two hours of becoming aware of the breach, as required by GDPR.

Data Retention

We retain personal data only as long as necessary for the purposes collected. Consultation records are retained for three years after service completion to support follow-up consultations and service continuity.

After retention periods expire, we securely delete or anonymize personal data unless legal obligations require continued retention.

Exercising Your Rights

To exercise any of your data protection rights, submit a written request to [email protected]. Include sufficient information to identify you and specify which right you wish to exercise.

We will respond to requests within one month. If your request is complex or we receive multiple requests from you, we may extend this period by two months, in which case we will inform you of the extension and reasons.

We do not charge fees for exercising your rights unless your request is clearly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO contact information:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Policy Updates

We may update this GDPR compliance statement to reflect changes in our processing activities or legal requirements. Material changes will be communicated to active service users via email.

Last updated: September 2026