Last updated: May 10, 2026
Although the UK has left the European Union, we continue to comply with the principles of the General Data Protection Regulation (GDPR) as incorporated into UK law through the UK GDPR and Data Protection Act 2018. We are committed to protecting your personal data and respecting your privacy rights.
For the purposes of data protection legislation, cloudy-arc is the data controller. We are responsible for deciding how we hold and use personal information about you.
Contact details:
Email: [email protected]
Address: 42 Meadowbank Street, Edinburgh EH8 7DY, United Kingdom
We process your personal data under the following lawful bases:
Given the nature of our services, we process special category data including health information and details about disabilities. We process this data under the following conditions:
Under the UK GDPR, you have the following rights:
You have the right to be informed about the collection and use of your personal data. This GDPR statement and our Privacy Policy fulfill this obligation.
You have the right to request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
You have the right to request correction of inaccurate or incomplete personal data we hold about you.
You have the right to request deletion or removal of personal data where there is no compelling reason for its continued processing. This right is not absolute and only applies in certain circumstances.
You have the right to request restriction of processing of your personal data in specific circumstances, such as when you contest the accuracy of the data.
You have the right to request transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
You have the right to object to processing of your personal data where we are relying on legitimate interests (or those of a third party).
We do not use automated decision-making or profiling in our services.
To exercise any of your rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two further months in complex cases.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.
We do not routinely transfer personal data outside the United Kingdom. If such transfers become necessary, we will ensure appropriate safeguards are in place as required by UK GDPR.
We have not appointed a Data Protection Officer as we are not required to do so under UK GDPR. However, our data protection practices are overseen by our senior management team.
If you believe we have not complied with your data protection rights, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
We may update this GDPR compliance statement from time to time. Any changes will be posted on this page with an updated revision date.