GDPR Compliance

Last updated: September 2026

Atoll Atom Ltd is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page provides information about how we handle your personal data in accordance with these regulations.

Data Controller

Atoll Atom Ltd is the data controller responsible for your personal data. Our contact details are:

Atoll Atom Ltd
47 Meadow Lane
Cambridge, CB2 1QW
United Kingdom

Email: [email protected]

Your Rights Under GDPR

The UK GDPR provides you with specific rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights:

Right to Access

You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request. We will respond to valid requests within one month.

Right to Rectification

If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will address such requests promptly and update our records accordingly.

Right to Erasure

Also known as the "right to be forgotten", you may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.

Right to Restrict Processing

You have the right to request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning you. We do not currently engage in such automated decision-making.

Lawful Basis for Processing

We process personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our contract with you when you purchase our products
• Consent: Where you have freely given specific, informed, and unambiguous consent
• Legitimate Interests: Where processing is necessary for our legitimate business interests and does not unduly impact your rights
• Legal Obligation: Where processing is required to comply with our legal obligations

Data Protection Principles

We adhere to the following data protection principles:

• Lawfulness, fairness, and transparency: We process data lawfully and inform you about how we use it
• Purpose limitation: We collect data for specified, explicit purposes and do not process it incompatibly with those purposes
• Data minimisation: We only collect data that is adequate, relevant, and necessary
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date
• Storage limitation: We do not keep personal data longer than necessary
• Integrity and confidentiality: We process data securely to protect against unauthorised access or loss
• Accountability: We take responsibility for compliance with these principles

International Data Transfers

We primarily store and process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place to protect your data in compliance with applicable regulations.

Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. We will also report qualifying breaches to the Information Commissioner's Office within 72 hours of becoming aware of them.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with your request. We will respond within one month. If your request is complex or we receive multiple requests, we may extend this period by an additional two months, in which case we will inform you of the extension.

We may need to verify your identity before processing your request to ensure we are providing information to the correct person.

Complaints

If you are not satisfied with our response to your request or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF

Website: ico.org.uk

Updates to This Information

We may update this GDPR compliance information periodically. The date of the latest revision will be noted at the top of this page.