GDPR Compliance

Last updated: 18 June 2026

Our Commitment to GDPR

calm-fable.com is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This document outlines how we comply with GDPR requirements and your rights under this regulation.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary to fulfil equipment rental agreements and provide services you have requested
• Legitimate Interest: Processing necessary for our business operations, provided your rights are not overridden
• Consent: Processing based on your explicit consent, which you may withdraw at any time
• Legal Obligation: Processing required to comply with legal and regulatory requirements

Your Rights Under GDPR

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information free of charge within one month of your request.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or completion of that information.

Right to Erasure

You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or if you withdraw consent on which processing is based.

Right to Restriction of Processing

You may request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not complied with GDPR requirements.

Data Protection Officer

For any questions regarding data protection or to exercise your GDPR rights, please contact us at [email protected] with "Data Protection" in the subject line.

Data Processing Activities

What Data We Collect

We collect and process the following categories of personal data:

• Identity data (name, title)
• Contact data (email address, postal address)
• Transaction data (rental history, payment information)
• Technical data (IP address, browser type, device information)
• Usage data (website interaction, service preferences)

How We Use Your Data

We use your personal data for:

• Processing and fulfilling equipment rental requests
• Managing customer relationships and communications
• Improving our services and website
• Complying with legal and regulatory obligations
• Protecting against fraud and ensuring security

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel only
• Staff training on data protection and security practices
• Incident response procedures for data breaches

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Rental and transaction records: 7 years (accounting and tax requirements)
• Marketing consent data: Until consent is withdrawn
• Website analytics data: 26 months
• Email communications: Duration of customer relationship plus 2 years

International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and European Economic Area. Any transfers outside these regions are subject to appropriate safeguards in accordance with GDPR requirements.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Changes to This Policy

We may update this GDPR compliance document to reflect changes in our practices or legal requirements. Significant changes will be communicated directly to affected individuals where appropriate.

Contact Us

To exercise any of your GDPR rights or for questions about data protection, contact us at [email protected].