GDPR Compliance

Last updated: September 2026

Our Commitment to GDPR

Canyon-field is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise the importance of protecting personal data and ensuring that individuals can exercise their rights under data protection law.

Data Controller Information

For the purposes of data protection legislation, canyon-field acts as the data controller for personal information collected through our website and services.

Contact address:
Canyon-field
47 Clerkenwell Road
London, EC1M 5RS
United Kingdom

Email: [email protected]

Lawful Bases for Processing

We process personal data under the following lawful bases as defined by Article 6 of the GDPR:

• Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose, such as responding to enquiries submitted through our contact form.
• Contract (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract, such as processing equipment rental bookings.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate interests or the legitimate interests of a third party, unless overridden by your data protection interests. This includes operating and improving our services.
• Legal Obligation (Article 6(1)(c)): Where processing is necessary to comply with a legal obligation, such as maintaining financial records.

Your Rights Under GDPR

The GDPR provides the following rights for individuals:

Right to be Informed (Articles 13 and 14)
You have the right to be informed about how we collect and use your personal data. This information is provided through this notice and our Privacy Policy.

Right of Access (Article 15)
You have the right to request a copy of the personal data we hold about you. We will respond to such requests within one month.

Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected or incomplete data completed.

Right to Erasure (Article 17)
Also known as the right to be forgotten, you may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected.

Right to Restrict Processing (Article 18)
You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of your data.

Right to Data Portability (Article 20)
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used format.

Right to Object (Article 21)
You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making (Article 22)
You have rights in relation to automated decision making and profiling. We do not currently engage in automated decision making that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive numerous requests, we may extend this period by a further two months, in which case we will inform you within the initial one-month period.

We may need to verify your identity before processing your request. There is no fee to exercise your rights unless your request is manifestly unfounded or excessive.

Data Protection Officer

Given the scale and nature of our data processing activities, we are not required to appoint a Data Protection Officer. However, any data protection queries should be directed to [email protected].

International Data Transfers

We primarily process data within the United Kingdom. If any personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR.

Data Breach Procedures

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF

Website: ico.org.uk