Last updated: 8 September 2026
indigomere is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This statement outlines how we meet our obligations as a data controller when processing personal information.
indigomere is the data controller responsible for personal information collected through this website and during the provision of consulting services.
Contact details:
17 Melville Street
Edinburgh, EH3 7PE
United Kingdom
[email protected]
We process personal data under the following lawful bases as defined by UK GDPR:
Under UK GDPR, individuals have the following rights regarding their personal data:
You may request confirmation of whether we process your personal data and obtain a copy of that data.
You may request correction of inaccurate or incomplete personal information.
You may request deletion of your personal data where there is no compelling reason for its continued processing, subject to legal retention obligations.
You may request limitation of how we process your data in specific circumstances, such as while accuracy is being verified.
You may request that we transfer your personal data to another organisation or provide it to you in a structured, commonly used format.
You may object to processing based on legitimate interests or for direct marketing purposes.
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of the rights outlined above, contact us at [email protected]. We will respond to requests within one month, as required by UK GDPR. In complex cases, we may extend this period by two months and will notify you accordingly.
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or to meet legal obligations. Retention periods vary depending on the nature of the data and applicable legal requirements. Enquiry data is typically retained for three years unless an ongoing relationship exists.
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments. While we take all reasonable steps to protect data, no transmission over the internet can be guaranteed as completely secure.
Personal data collected through this website is primarily stored and processed within the United Kingdom. If data is transferred outside the UK, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses approved by the UK Information Commissioner's Office.
We engage third-party service providers for website hosting, email services, and analytics. These processors are contractually obligated to process data only in accordance with our instructions and to implement appropriate security measures.
In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Affected individuals will be informed without undue delay where the breach is likely to result in high risk.
If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the supervisory authority:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk
We may update this GDPR compliance statement to reflect changes in our data processing practices or legal obligations. Updates will be posted on this page with a revised date.