GDPR Compliance

Last Updated: September 29, 2026

Our Commitment to GDPR Compliance

Canopy-stag Limited is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We process personal data lawfully, fairly, and transparently, ensuring that your privacy rights are respected at all times.

Data Controller Information

Data Controller: Canopy-stag Limited
Registered Address: 42 Kingsway Terrace, Birmingham, B15 3TN, United Kingdom
Contact Email: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by UK GDPR:

Contract Performance (Article 6(1)(b))

Processing is necessary to perform our contract with you when you request our ATM card recovery services. This includes:

• Processing service requests
• Coordinating with ATM operators
• Communicating about case progress
• Delivering the requested services

Legitimate Interests (Article 6(1)(f))

We process data based on our legitimate business interests, which include:

• Improving our services and website
• Preventing fraud and maintaining security
• Managing customer relationships
• Analyzing service effectiveness

We have assessed that these interests do not override your fundamental rights and freedoms.

Consent (Article 6(1)(a))

For certain processing activities, such as marketing communications, we obtain your explicit consent. You may withdraw this consent at any time.

Legal Obligation (Article 6(1)(c))

We process data when required to comply with legal obligations, such as responding to law enforcement requests or maintaining records for regulatory purposes.

Your Rights Under GDPR

Right to Be Informed

You have the right to clear information about how we collect and use your personal data. This information is provided in our Privacy Policy and this GDPR statement.

Right of Access

You can request a copy of the personal data we hold about you. We will provide this information within one month of your request, free of charge.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to have it corrected. We will make corrections within one month of notification.

Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Deletion is required to comply with a legal obligation

Right to Restriction of Processing

You can request that we restrict processing of your personal data in certain circumstances:

• When you contest the accuracy of the data
• When processing is unlawful but you prefer restriction to erasure
• When we no longer need the data but you need it for legal claims
• When you have objected to processing pending verification

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transmit this data directly to another controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects. Should this change, you would have the right to human intervention, to express your point of view, and to contest the decision.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. Include the following in your request:

• Your full name and contact information
• Specific details about which right you wish to exercise
• Any relevant reference numbers or dates of interaction with our services

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of the extension.

Identity Verification

To protect your privacy, we may need to verify your identity before responding to requests to exercise your rights. We may request additional information to confirm your identity.

Data Protection Principles

We adhere to the following data protection principles:

• Lawfulness, fairness, and transparency: We process data lawfully and openly
• Purpose limitation: We collect data for specific, explicit, and legitimate purposes
• Data minimization: We only collect data that is adequate, relevant, and necessary
• Accuracy: We keep data accurate and up to date
• Storage limitation: We retain data only as long as necessary
• Integrity and confidentiality: We protect data with appropriate security measures
• Accountability: We take responsibility for compliance and can demonstrate it

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Third-Party Data Processors

When we engage third-party service providers who process personal data on our behalf, we ensure they:

• Provide sufficient guarantees of technical and organizational security measures
• Process data only according to our documented instructions
• Are bound by contractual obligations regarding data protection
• Comply with UK GDPR requirements

International Data Transfers

If we transfer your personal data outside the United Kingdom, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the UK authorities
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules for intra-group transfers

Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Updates to This Statement

We review and update this GDPR compliance statement regularly to ensure it remains accurate and reflects current practices and legal requirements. Material changes will be clearly indicated.