GDPR Compliance

buddlsuper is committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we comply with these requirements.

Data Controller

buddlsuper acts as the data controller for personal information collected through this website and our consulting services. This means we determine the purposes and means of processing your personal data.

Contact details:
buddlsuper
47 Colmore Row
Birmingham, B3 2BS
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so:

Consent

When you submit an enquiry form or opt into communications, you provide consent for us to process your information for the stated purposes. You may withdraw consent at any time by contacting us.

Contract Performance

Processing necessary to deliver services you have engaged, including energy audits, consulting reports, and related deliverables.

Legitimate Interests

We may process data for legitimate business purposes such as improving our services, provided these interests do not override your fundamental rights. Examples include website analytics and service quality improvement.

Legal Obligation

Processing required to comply with legal requirements, including financial record keeping and regulatory reporting.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access

You may request a copy of personal data we hold about you. We will respond within one month of receiving your request.

Right to Rectification

You may request correction of inaccurate personal data. We will update records promptly upon verification.

Right to Erasure

In certain circumstances, you may request deletion of your personal data. This applies when data is no longer necessary for its original purpose, you withdraw consent, or processing was unlawful.

Right to Restrict Processing

You may request limitation of processing in specific situations, such as when accuracy is contested or processing is unlawful but you prefer restriction over deletion.

Right to Data Portability

You may request personal data you provided in a structured, commonly used, machine-readable format for transfer to another organisation.

Right to Object

You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.

Data Protection Principles

We adhere to the core principles of UK GDPR:

• Lawfulness, fairness, transparency: We process data lawfully and explain our practices clearly
• Purpose limitation: Data is collected for specified, explicit purposes
• Data minimisation: We collect only what is necessary
• Accuracy: We keep personal data accurate and up to date
• Storage limitation: Data is retained only as long as necessary
• Integrity and confidentiality: Appropriate security measures protect your data
• Accountability: We document our compliance and can demonstrate it

Data Breach Procedures

We maintain procedures to detect, report, and investigate personal data breaches. Where a breach is likely to result in a risk to individual rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and affected individuals without undue delay.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk

We encourage you to contact us first so we can address your concerns directly.

Updates

This page may be updated to reflect changes in our practices or legal requirements. Material changes will be communicated through our website.

Last updated: August 2026