GDPR Compliance

Last updated: September 1, 2026

spring-loop is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws. This document outlines how we comply with GDPR requirements and your rights as a data subject.

Data Controller Information

spring-loop acts as the data controller for personal information collected through our website and services. Our contact details:

spring-loop
142 Cromwell Road
Kensington, London SW7 4EF
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so:

Consent

When you submit an inquiry form or sign up for communications, you provide explicit consent for us to process your personal data for the specified purposes. You may withdraw this consent at any time.

Contractual Necessity

Processing is necessary to perform our contractual obligations when you engage our services for property search assistance, viewing coordination, or other offerings.

Legitimate Interests

We process certain data based on legitimate business interests, such as improving our services, preventing fraud, and maintaining website security. We balance these interests against your rights and freedoms.

Legal Obligations

We process data when required to comply with legal obligations, including tax laws, financial regulations, and law enforcement requests.

Your GDPR Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right to Access

You may request confirmation of whether we process your personal data and obtain a copy of that data. We will provide this information in a structured, commonly used format within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or completion. We will update your information promptly upon verification.

Right to Erasure

You may request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and no other legal basis exists
• You object to processing and no overriding legitimate grounds exist
• The data has been unlawfully processed
• Legal obligations require erasure

Right to Restriction of Processing

You may request that we limit processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, machine-readable format and transmit it to another controller when technically feasible.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal effects or significantly affects you.

How to Exercise Your Rights

To exercise any of your GDPR rights, contact us at [email protected]. Please include:

• Your full name and contact information
• Specific right you wish to exercise
• Details of your request
• Proof of identity if necessary

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months and will notify you accordingly.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure data security:

• Encryption of data in transit and at rest
• Access controls limiting who can view personal data
• Regular security assessments and updates
• Employee training on data protection principles
• Secure data backup and recovery procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware. If the breach poses a high risk, we will also inform affected individuals without undue delay.

International Data Transfers

When transferring personal data outside the European Economic Area, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions confirming recipient countries provide adequate protection
• Binding corporate rules where applicable

Data Retention

We retain personal data only as long as necessary for the purposes outlined in our privacy policy or as required by law. Retention periods vary based on data type and purpose:

• Inquiry data: 3 years from last contact
• Client service records: 6 years from service completion
• Financial records: 7 years as required by law
• Marketing consent: Until withdrawn or 2 years of inactivity

Complaints

If you believe we have not complied with GDPR requirements, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: ico.org.uk

Updates to This Policy

We review and update this GDPR compliance document periodically to reflect changes in regulations or our practices. Significant changes will be communicated through our website.