Last updated: July 8, 2026
We are committed to complying with the General Data Protection Regulation and protecting the rights of individuals whose personal data we process. This page explains how we fulfill our obligations under GDPR.
debostrasa acts as the data controller for personal information collected through our website and services. We are responsible for ensuring that your data is processed lawfully, fairly, and transparently.
Contact details:
debostrasa
47 Frederick Street
Edinburgh EH2 1EP
United Kingdom
Email: [email protected]
We process personal data under the following lawful bases:
You have the following rights regarding your personal data:
You can request a copy of the personal data we hold about you. We will provide this information within one month of your request.
If your personal data is inaccurate or incomplete, you have the right to request correction.
You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purpose it was collected.
You can request that we limit how we use your data in specific situations, such as while we verify its accuracy.
You can request a copy of your data in a structured, commonly used format that can be transferred to another service provider.
You can object to processing based on legitimate interests or for direct marketing purposes.
Where we process data based on your consent, you can withdraw that consent at any time.
To exercise any of these rights, send a written request to [email protected]. We will respond within one month. If your request is complex or we receive multiple requests, we may extend this period by two months and will notify you accordingly.
We may need to verify your identity before fulfilling your request to protect your personal information from unauthorized access.
We adhere to the following data protection principles:
We primarily store and process data within the United Kingdom. If we transfer data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.
We do not use automated decision making or profiling that produces legal effects or similarly significant impacts on individuals.
Our services are not directed at children under 16. We do not knowingly collect personal data from children without parental consent.
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.
ICO contact information:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk
We may update this GDPR compliance information periodically to reflect changes in our practices or legal requirements. Please check this page regularly for updates.