GDPR Compliance Statement

Last Updated: November 3, 2026

1. Our Commitment to GDPR Compliance

Link-raven is committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR). This statement explains how we fulfill our obligations under GDPR when processing your personal data.

2. Data Controller Information

For the purposes of GDPR, Link-raven acts as the data controller. Our contact details are:

Link-raven
Heritage House, 42 Kensington Gardens
London, W2 4RB
United Kingdom
Email: [email protected]

3. Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by GDPR:

• Consent: You have given clear consent for us to process your personal data for specific purposes, such as marketing communications.
• Contract: Processing is necessary for the performance of a contract with you, such as booking and delivering heritage experiences.
• Legal Obligation: Processing is necessary to comply with legal obligations, such as tax and accounting requirements.
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms.

4. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

4.1 Right to Access

You have the right to request access to the personal data we hold about you. We will provide you with a copy of your data in a commonly used electronic format.

4.2 Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it.

4.3 Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when there is no compelling reason for us to continue processing it.

4.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

4.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another data controller.

4.6 Right to Object

You have the right to object to our processing of your personal data based on legitimate interests or for direct marketing purposes.

4.7 Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

5. How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at [email protected] with "GDPR Request" in the subject line. We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will notify you accordingly.

6. Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel only
• Staff training on data protection principles
• Incident response procedures for data breaches

7. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations:

• Booking and transaction data: 7 years (accounting and legal requirements)
• Marketing consent records: Until consent is withdrawn or 3 years of inactivity
• Correspondence: 2 years from last interaction
• Website analytics data: 26 months

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in such risk.

9. International Data Transfers

When transferring personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Binding corporate rules where applicable

10. Third-Party Processing

When we engage third-party processors to handle personal data on our behalf, we ensure they:

• Process data only on our documented instructions
• Implement appropriate security measures
• Comply with GDPR requirements
• Maintain confidentiality

11. Children's Data

We do not knowingly process personal data of children under 16 years of age without parental consent. If you believe we have inadvertently collected such data, please contact us immediately.

12. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority in your jurisdiction. In the UK, this is the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

13. Updates to This Statement

We may update this GDPR Compliance Statement to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website and, where appropriate, via direct notification.

14. Contact Us

For questions or concerns about our GDPR compliance, please contact us at [email protected]