GDPR Compliance Statement

1. Our Commitment to GDPR Compliance

Evergreen Marketing Group Ltd is fully committed to compliance with the General Data Protection Regulation (GDPR) and UK GDPR. This statement outlines our approach to data protection, your rights as a data subject, and how we ensure lawful processing of personal data in all our marketing activities.

2. Data Controller Information

3. Lawful Basis for Processing

We process personal data under the following lawful bases:

3.1 Consent (Article 6(1)(a))

• Marketing communications and newsletters
• Non-essential cookies and tracking
• Sharing data with advertising platforms for retargeting
• Processing special category data (where applicable)

3.2 Contract Performance (Article 6(1)(b))

• Delivering advertising services as contracted
• Campaign setup and optimization
• Performance reporting and analysis
• Customer support and service communications

3.3 Legitimate Interests (Article 6(1)(f))

• Website functionality and security
• Business analytics and service improvement
• Fraud prevention and security monitoring
• Direct marketing to existing clients (with opt-out)

3.4 Legal Obligations (Article 6(1)(c))

• Financial record keeping and tax compliance
• Regulatory reporting requirements
• Legal proceedings and dispute resolution

4. Your Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

4.1 Right of Access (Article 15)

You can request a copy of all personal data we hold about you, including:

• What data we process and why
• Who we share it with
• How long we keep it
• Your rights regarding the data

4.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

4.3 Right to Erasure (Article 17)

You can request deletion of your data when:

• The data is no longer necessary for the original purpose
• You withdraw consent and no other lawful basis applies
• The data has been unlawfully processed
• Legal obligations require erasure

4.4 Right to Restrict Processing (Article 18)

You can request limitation of processing in specific circumstances.

4.5 Right to Data Portability (Article 20)

For data processed based on consent or contract, you can receive your data in a structured, machine-readable format.

4.6 Right to Object (Article 21)

You can object to processing based on legitimate interests or direct marketing.

4.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting prior lawful processing.

5. How to Exercise Your Rights

6. Data Protection Measures

6.1 Technical Safeguards

• Encryption of data in transit and at rest
• Multi-factor authentication for system access
• Regular security assessments and penetration testing
• Automated backup and disaster recovery procedures
• Access controls and audit logging

6.2 Organizational Measures

• Regular GDPR training for all staff
• Data protection impact assessments for high-risk processing
• Incident response and breach notification procedures
• Privacy by design and default principles
• Regular review and updating of privacy policies

7. International Data Transfers

When we transfer personal data outside the UK/EU, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with adequate data protection
• Standard Contractual Clauses: EU-approved contract terms for data transfers
• Binding Corporate Rules: For transfers within multinational organizations
• Certification Schemes: Recognized privacy certification programs

Current International Transfers

8. Data Breach Procedures

In the event of a personal data breach, we will:

• Assess the breach within 72 hours of discovery
• Notify the Information Commissioner's Office (ICO) if required
• Inform affected individuals if there is a high risk to their rights and freedoms
• Document the breach and response measures
• Review and improve security measures to prevent similar incidents

9. Children's Data Protection

Our services are designed for businesses and adults. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected such data, we will delete it promptly and notify the appropriate authorities if required.

10. Third-Party Data Processors

We work with carefully selected data processors who provide adequate security measures and GDPR compliance. All processors are bound by data processing agreements that include:

• Specific processing instructions and limitations
• Confidentiality and security obligations
• Assistance with data subject requests
• Data deletion or return upon contract termination
• Regular compliance audits and assessments

11. Complaints and Supervisory Authority

If you believe we have not handled your data appropriately, you can:

• Contact our Data Protection Officer: dpo@evergreen-growth.com
• File a complaint with the Information Commissioner's Office (ICO)

12. Regular Compliance Reviews

We conduct regular reviews of our GDPR compliance, including:

• Annual data protection impact assessments
• Quarterly staff training updates
• Regular policy and procedure reviews
• External compliance audits
• Continuous monitoring of regulatory changes

13. Contact Information