Conciptual Ltd — home
Experiments See our work

Legal & Data Protection

GDPR Compliance Statement

How Conciptual Ltd complies with the UK GDPR, Data Protection Act 2018 and EU GDPR to safeguard your personal data.

Conciptual Ltd is committed to ensuring full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and where applicable, the EU GDPR. We take our responsibilities as a data controller and data processor seriously, adhering to strict standards of transparency, confidentiality and security.

1. Data Controller Information

The data controller responsible for the processing of your personal data is:

  • Company Name: CONCIPTUAL LTD
  • Registration: Registered in England and Wales at Companies House
  • Company Number: 11338306
  • Registered Office: London, United Kingdom
  • Branch Office: Constanța, Romania
  • Email: office@conciptual.co.uk
  • Telephone: +40 791 595 545

2. Core Data Protection Principles

Under Article 5 of the UK GDPR, Conciptual Ltd ensures that all personal data is:

  • Processed lawfully, fairly and transparently — with clear explanations and identified legal bases.
  • Collected for specified, explicit and legitimate purposes — and never used in ways incompatible with those purposes.
  • Adequate, relevant and limited — to what is strictly necessary in relation to the purposes for which it is processed (data minimisation).
  • Accurate and kept up to date — with reasonable steps taken to rectify or erase inaccurate data without delay.
  • Retained only as long as necessary — adhering to defined retention schedules and securely deleted thereafter.
  • Processed securely — protected against unauthorised access, unlawful processing, accidental loss, destruction or damage using appropriate technical and organisational safeguards.

3. Lawful Bases for Processing

We only collect and process personal data when we have a valid lawful basis under Article 6 of the UK GDPR:

  • Contractual Necessity: Processing required to enter into, negotiate, or perform a contract for our digital, software, cloud or marketing services.
  • Legitimate Interests: Processing necessary for our legitimate commercial interests, such as managing client communications, improving website performance, and safeguarding our infrastructure, balanced against your individual privacy rights.
  • Legal Obligation: Processing required to comply with statutory and regulatory obligations, including tax, accounting, and corporate reporting requirements under UK law.
  • Consent: Where required (for example, specific optional cookies or direct marketing communications), we obtain prior, explicit, and freely given consent, which can be withdrawn at any time.

4. Your Rights as a Data Subject

The UK GDPR and EU GDPR grant you specific, legally enforceable rights regarding your personal data:

  • Right of Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you and details of how it is processed.
  • Right to Rectification: You have the right to request the prompt correction of inaccurate or incomplete personal information.
  • Right to Erasure ("Right to be Forgotten"): You have the right to request the deletion of your personal data where there is no overriding legal reason for us to retain it.
  • Right to Restrict Processing: You have the right to request that we pause the processing of your personal data under certain conditions.
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format to transmit to another service provider.
  • Right to Object: You have the right to object at any time to processing based on legitimate interests or direct marketing.
  • Rights Regarding Automated Decisions: We do not conduct automated profiling or make significant decisions based solely on automated processing.

5. How to Exercise Your Rights

To exercise any of your data protection rights, please contact our privacy team by email at office@conciptual.co.uk with the subject line "Data Protection Request".

We do not charge a fee for responding to requests unless they are manifestly unfounded or excessive. We will acknowledge your request promptly and provide our substantive response within one calendar month, as required by law.

6. International Data Transfers

As a technology company operating between the United Kingdom and our branch in Constanța, Romania (European Union), transfers between the UK and the EEA are safeguarded by mutual adequacy decisions adopted by the European Commission and the UK Government.

Where personal data is transferred to third-party sub-processors located outside the UK/EEA (for example, enterprise cloud hosting providers), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and robust encryption in transit and at rest.

7. Technical and Organisational Security Measures

We enforce rigorous technical and organisational security controls, including:

  • End-to-end TLS/HTTPS encryption across all public web and API endpoints.
  • Role-based access controls (RBAC) ensuring only authorised personnel have access to client data.
  • Static site architecture that eliminates database injection vulnerabilities on the public website.
  • Regular vulnerability scanning, dependency audits, and secure infrastructure configurations on Cloudflare and enterprise cloud platforms.

8. Right to Lodge a Complaint

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can resolve the matter. You also have the legal right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk
Helpline: 0303 123 1113

If you reside in the EEA, you may also lodge a complaint with your local National Data Protection Authority.

9. Related Legal Documents

Please review our related legal policies for further details on how we operate:

Last updated: 1 July 2025 • CONCIPTUAL LTD (Company No. 11338306)