Last updated: June 19, 2026
Our Commitment to GDPR
lush-marten is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and explains your rights under this regulation.
Legal Basis for Processing
We process your personal data under the following legal bases:
- Consent: When you provide explicit consent for specific processing activities
- Contractual necessity: When processing is necessary to fulfill our service obligations to you
- Legitimate interests: When we have legitimate business interests that do not override your rights
- Legal obligations: When we must process data to comply with legal requirements
Your Rights Under GDPR
As a data subject, you have the following rights:
Right to Access
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. We will provide this information in a commonly used electronic format upon request.
Right to Rectification
If your personal data is inaccurate or incomplete, you have the right to request correction or completion. We will respond to such requests within one month.
Right to Erasure
Under certain circumstances, you have the right to request deletion of your personal data. This applies when:
- The data is no longer necessary for the purposes it was collected
- You withdraw consent and there is no other legal basis for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
- Erasure is required to comply with a legal obligation
Right to Restrict Processing
You may request restriction of processing when:
- You contest the accuracy of your personal data
- Processing is unlawful but you prefer restriction to erasure
- We no longer need the data but you require it for legal claims
- You have objected to processing pending verification of legitimate grounds
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transmit this data directly to another controller where technically feasible.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Upon receiving an objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO).
Data Protection Measures
We implement appropriate technical and organizational measures to ensure data security, including:
- Encryption of personal data in transit and at rest
- Regular security assessments and audits
- Access controls limiting data access to authorized personnel
- Staff training on data protection principles
- Incident response procedures for data breaches
Data Breach Notification
In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
International Data Transfers
We primarily process data within the United Kingdom. If we transfer personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by relevant authorities.
Data Protection Officer
For questions regarding GDPR compliance or to exercise your rights, please contact us at:
Email: [email protected]
Address: 15 Berkeley Street, Mayfair, London W1J 8DY, United Kingdom
Exercising Your Rights
To exercise any of your GDPR rights, please submit a written request via email to the contact address provided above. We will respond to your request within one month, or two months for complex requests. We may request additional information to verify your identity before processing your request.
We do not charge a fee for exercising your rights unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.