GDPR Compliance Statement

Last Updated: May 10, 2026

Our Commitment to Data Protection

Nebulous Ray is committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We take the protection of your personal data seriously and have implemented comprehensive measures to ensure compliance.

Data Controller Information

Data Controller: Nebulous Ray
Address: 47 Wellington Street, Manchester M12 5PB, United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Article 6(1)(b) - Contractual Necessity: Processing is necessary to perform our pension advisory services
• Article 6(1)(c) - Legal Obligation: Processing is required to comply with financial services regulations
• Article 6(1)(f) - Legitimate Interests: Processing for business operations and service improvement
• Article 6(1)(a) - Consent: Where you have provided explicit consent for specific processing activities

Special Category Data

In providing pension planning services, we may process special category data relating to your health or circumstances affecting retirement planning. We process such data only:

• With your explicit consent (Article 9(2)(a))
• When necessary for the establishment, exercise, or defense of legal claims (Article 9(2)(f))
• When authorized by UK law for regulatory purposes (Article 9(2)(g))

Your GDPR Rights

Right to Access (Article 15)

You have the right to request confirmation that we are processing your personal data and to receive a copy of that data. We will respond to access requests within one month.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure (Article 17)

You may request deletion of your personal data where there is no compelling reason for continued processing. However, financial services regulations require us to retain certain records for specified periods.

Right to Restriction (Article 18)

You can request that we restrict processing of your personal data in certain circumstances, such as while we verify accuracy or assess legal claims.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making (Article 22)

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects.

Exercising Your Rights

To exercise any of your GDPR rights, contact us at:

Email: [email protected]
Address: 47 Wellington Street, Manchester M12 5PB, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of any extension.

Data Security Measures

We have implemented appropriate technical and organizational measures as required by Article 32, including:

• Pseudonymization and encryption of personal data
• Ongoing confidentiality, integrity, availability, and resilience of processing systems
• Regular testing and evaluation of security measures
• Processes for restoring data availability in case of incidents

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office within 72 hours of becoming aware of a breach, as required by Article 33.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals' rights and freedoms, as required by Article 35.

International Data Transfers

Your personal data is primarily processed within the United Kingdom. Any international transfers comply with Chapter V of the GDPR, using appropriate safeguards such as:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses approved by the Commission
• Binding Corporate Rules where applicable

Third-Party Processors

We work with third-party processors who handle personal data on our behalf. All processors are bound by data processing agreements that comply with Article 28 requirements, ensuring they:

• Process data only on our documented instructions
• Maintain appropriate security measures
• Assist with fulfilling your rights
• Delete or return data at the end of services

Children's Data

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children.

Supervisory Authority

The UK supervisory authority for data protection is:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: nebulous-ray.com

You have the right to lodge a complaint with the ICO if you believe our processing of your personal data violates data protection law.

Regular Review

We regularly review our data protection practices to ensure ongoing compliance with GDPR requirements. This statement is reviewed and updated as necessary to reflect changes in our processing activities or legal requirements.

Contact for GDPR Matters

For specific GDPR-related inquiries or to exercise your rights:

Email: [email protected]
Reference: GDPR Inquiry