GDPR Compliance Statement

Last updated: June 2026

Our Commitment to Data Protection

crisp-root.com is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with these regulations and your rights as a data subject.

Data Controller Information

The data controller responsible for your personal information is:

crisp-root
47 Cromwell Road
Kensington, London SW7 2EF
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so under UK GDPR. The lawful bases we rely on include:

Contract Performance

Processing is necessary to perform our contract with you when you rent a vehicle from us. This includes:

• Managing your reservation
• Verifying driving credentials
• Processing payments
• Providing customer support

Legal Obligation

We must process certain data to comply with legal requirements, such as:

• Maintaining financial records for tax purposes
• Verifying driver eligibility
• Complying with insurance regulations
• Responding to lawful requests from authorities

Legitimate Interests

We may process data based on legitimate business interests, provided these do not override your rights:

• Preventing fraudulent bookings
• Improving our services through analytics
• Protecting our business assets
• Managing customer relationships

Consent

For certain activities, we request your explicit consent:

• Marketing communications
• Optional cookies and tracking
• Sharing feedback or testimonials

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Your Data Protection Rights

Under UK GDPR, you have the following rights:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.

Right to Rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Right to Restriction of Processing

You can request that we limit how we use your data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over deletion
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

You can request to receive your personal data in a structured, commonly used, machine-readable format, or have it transmitted directly to another controller where technically feasible.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at:

Email: [email protected]
Post: 47 Cromwell Road, Kensington, London SW7 2EF

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of the extension.

Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication protocols
• Staff training on data protection obligations
• Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

Third-Party Processing

We only share your personal data with third-party processors who provide sufficient guarantees of compliance with UK GDPR. We maintain written contracts with all processors that specify their data protection obligations.

International Transfers

Your personal data is primarily processed within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by UK authorities
• Adequacy decisions for the receiving country
• Binding corporate rules

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Specific retention periods are detailed in our Privacy Policy.

Children's Data

We do not knowingly process personal data of individuals under 18 years of age. Our services are intended for adults only.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will notify you of significant changes through our website or direct communication.

Complaints

If you believe we have not complied with UK GDPR, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Tel: 0303 123 1113
Website: ico.org.uk

Contact Us

For any questions regarding our GDPR compliance or data protection practices, please contact us at [email protected]