GDPR Compliance

Last updated: 22 May 2026

Our Commitment to GDPR

syncro-flux is committed to full compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We take your privacy seriously and have implemented comprehensive measures to protect your personal data.

Data Controller

syncro-flux acts as the data controller for the personal information you provide to us. Our details:

syncro-flux Animal Care Centre
47 Deansgate Approach
Manchester, M3 2JG
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by GDPR:

1. Contract (Article 6(1)(b))

Processing is necessary to provide the pet care services you've requested and to fulfil our contractual obligations to you.

2. Legal Obligation (Article 6(1)(c))

We're legally required to maintain accurate veterinary records for a minimum period as mandated by the Royal College of Veterinary Surgeons (RCVS) and other regulatory bodies.

3. Legitimate Interests (Article 6(1)(f))

We process data to improve our services, prevent fraud, and communicate with clients about their ongoing care. We've assessed that these interests don't override your fundamental rights.

4. Consent (Article 6(1)(a))

For marketing communications and non-essential cookies, we rely on your explicit consent, which you can withdraw at any time.

Your GDPR Rights

Under GDPR, you have extensive rights regarding your personal data:

Right to Access (Article 15)

You can request a copy of all personal data we hold about you. We'll provide this within one month of your request, free of charge.

Right to Rectification (Article 16)

If your information is inaccurate or incomplete, you can request that we correct or complete it.

Right to Erasure (Article 17)

Also known as the "right to be forgotten." You can request deletion of your data, though this is subject to legal retention requirements for veterinary records.

Right to Restriction (Article 18)

You can request that we limit how we use your data while we address concerns you've raised.

Right to Data Portability (Article 20)

You can receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22)

We don't use automated decision-making or profiling that produces legal effects concerning you.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us:

• Email: [email protected] with the subject line "GDPR Request"
• Post: GDPR Requests, syncro-flux, 47 Deansgate Approach, Manchester, M3 2JG

We'll respond to your request within one month. If your request is complex, we may extend this by up to two months and will inform you of the extension.

Data Protection Impact Assessments

We conduct regular Data Protection Impact Assessments (DPIAs) for any processing activities that pose high risks to your rights and freedoms. This ensures we identify and minimise data protection risks.

Data Breach Notification

In the unlikely event of a personal data breach that's likely to result in a high risk to your rights, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
• Inform affected individuals without undue delay
• Provide clear information about the nature of the breach and steps taken
• Offer advice on protecting yourself from potential consequences

Third-Party Processing

When we engage third-party processors (such as payment providers or email services), we ensure they:

• Provide sufficient guarantees of GDPR compliance
• Process data only on our documented instructions
• Maintain appropriate security measures
• Assist us in fulfilling our GDPR obligations
• Delete or return data when no longer required

We maintain written contracts with all processors, as required by Article 28 GDPR.

International Transfers

Your data is primarily stored and processed within the United Kingdom. If we transfer data internationally, we ensure appropriate safeguards are in place:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by the ICO
• Binding corporate rules
• Certification schemes where appropriate

Data Retention

We retain personal data in accordance with legal requirements and our retention policy:

• Veterinary records: Minimum 6 years from last treatment (RCVS requirement)
• Financial records: 7 years (HMRC requirement)
• Marketing data: Until consent is withdrawn or data becomes outdated
• Website analytics: 26 months

After retention periods expire, we securely delete or anonymise data.

Children's Data

We don't knowingly process data of individuals under 16 without parental consent. If you're a parent or guardian and believe we've inadvertently collected data about a child, please contact us immediately.

Privacy by Design and Default

We implement privacy by design principles in all our systems and processes:

• Data minimisation—we only collect what's necessary
• Purpose limitation—data is used only for specified purposes
• Storage limitation—data is kept only as long as necessary
• Security—appropriate technical and organisational measures are in place
• Privacy-friendly default settings

Staff Training and Accountability

All staff members receive comprehensive GDPR training and sign confidentiality agreements. We maintain internal records of processing activities as required by Article 30 GDPR.

Updates to GDPR Practices

We regularly review and update our GDPR compliance measures. Material changes will be communicated through our website and, where appropriate, by email.

Supervisory Authority

Our lead supervisory authority is the Information Commissioner's Office (ICO). You have the right to lodge a complaint:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk
Telephone: 0303 123 1113

Questions About GDPR

If you have questions about our GDPR compliance or data protection practices, please contact us at [email protected].