GDPR Compliance

Last Updated: September 8, 2026

Our Commitment to GDPR

elm-ibis is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws. This page outlines how we comply with GDPR principles in our data processing activities.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for specific purposes, such as receiving communications
• Contract: When processing is necessary to fulfill a consulting services agreement
• Legal Obligation: When we must process data to comply with legal requirements
• Legitimate Interests: When processing serves our legitimate business interests while not overriding your rights

Your GDPR Rights

Under GDPR, you have comprehensive rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate personal data we hold about you.

Right to Erasure

You can request deletion of your personal data under certain circumstances.

Right to Restrict Processing

You can request that we limit how we use your personal data.

Right to Data Portability

You can receive your personal data in a structured, commonly used format and transmit it to another controller.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have rights regarding decisions made solely by automated means. We do not currently employ automated decision-making processes that significantly affect you.

Data Processing Activities

We process personal data for the following purposes:

• Providing energy consulting services
• Responding to inquiries and consultation requests
• Maintaining business records
• Improving our services and website functionality
• Complying with legal and regulatory requirements

Data Security Measures

We implement appropriate technical and organizational measures including:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorized personnel
• Regular security assessments and updates
• Staff training on data protection principles
• Secure backup procedures

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected or as required by law. Retention periods vary depending on the type of data and purpose of processing.

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at [email protected]. We will respond to your request within one month, or inform you if an extension is necessary.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk

Contact Us

For questions about our GDPR compliance or to exercise your rights, contact us at [email protected]