GDPR Compliance Statement

Last updated: 18 June 2026

Our Commitment to Data Protection

valley-echo operates in full compliance with the General Data Protection Regulation (GDPR) and UK data protection law. We recognize the importance of protecting your personal information and have implemented appropriate technical and organizational measures to ensure data security.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: When you request our services, we process your data to fulfill that contract, including scheduling audits and delivering reports.
• Legitimate Interests: We may process data for business administration, record-keeping, and service improvement where such processing does not override your rights.
• Legal Obligation: We retain certain records to comply with tax, accounting, and business regulations.
• Consent: For marketing communications or optional services, we obtain your explicit consent before processing your data.

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Ask us to correct inaccurate or incomplete information.
• Right to Erasure: Request deletion of your data when it is no longer necessary or if you withdraw consent.
• Right to Restriction: Ask us to limit processing under certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making: We do not use automated decision-making or profiling.

How to Exercise Your Rights

To exercise any of these rights, please submit a written request to [email protected] or send postal mail to our business address. We will respond within one month of receiving your request.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately. Contact details for the ICO can be found at ico.org.uk.

Data Retention

We retain client information for seven years after service completion to comply with business record requirements. After this period, personal data is securely deleted unless we have a legal obligation to retain it longer.

Marketing consent can be withdrawn at any time, and we will remove you from our marketing lists within 48 hours of receiving your request.

Data Security Measures

We employ industry-standard security measures to protect your data from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls limiting who can view personal information
• Regular security assessments and updates
• Staff training on data protection principles
• Secure disposal procedures for physical and electronic records

Data Transfers

We do not transfer personal data outside the United Kingdom. All data processing occurs within the UK using servers and facilities subject to UK data protection law.

Third-Party Data Processors

We may engage third-party service providers to assist with business operations, such as email hosting or appointment scheduling. These processors are carefully selected and contractually required to handle your data in accordance with GDPR requirements.

Contact for Data Protection Matters

For questions about GDPR compliance or to exercise your data protection rights, contact us at [email protected]. Please include "Data Protection Request" in the subject line.