GDPR Compliance
Last Updated: October 16, 2026
Our Commitment to Data Protection
Amethyst Mountain is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we comply with data protection legislation and outlines your rights as a data subject.
Data Controller
Amethyst Mountain acts as the data controller for personal information collected through our website and services. We determine how and why your personal data is processed.
Contact Details:
Amethyst Mountain
42 Berkeley Square
Mayfair, London W1J 5AW
United Kingdom
Email: [email protected]
Lawful Basis for Processing
We process personal data only when we have a lawful basis to do so. Our processing activities rely on:
Consent
When you submit inquiry forms or sign up for property alerts, you provide explicit consent for us to process your personal data for the specified purposes. You may withdraw this consent at any time.
Contractual Necessity
When you engage our services, processing your personal data is necessary to fulfill our contractual obligations to you.
Legitimate Interests
We may process data based on our legitimate business interests, such as improving our services, preventing fraud, or ensuring network security. We balance these interests against your rights and freedoms.
Legal Obligation
We process certain data to comply with legal requirements, such as tax obligations or responding to lawful requests from authorities.
Your Data Protection Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right to Access
You can request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.
Right to Rectification
You have the right to request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure
Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected or when you withdraw consent.
Right to Restrict Processing
You can request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data or object to our processing.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.
Right to Object
You can object to processing of your personal data when we rely on legitimate interests as our legal basis. You also have an absolute right to object to processing for direct marketing purposes.
Rights Related to Automated Decision Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects. If this changes, we will update this policy accordingly.
How to Exercise Your Rights
To exercise any of your data protection rights, please send a written request to [email protected] or contact us at the postal address provided above.
We may need to verify your identity before processing your request. We will respond to valid requests within one month, though this may be extended by two additional months for complex requests.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations.
- Inquiry data from non-clients: Retained for two years from last contact
- Client data from active engagements: Retained for the duration of service plus six years
- Financial records: Retained for six years in accordance with UK tax law
- Website analytics data: Retained for 26 months
International Data Transfers
We do not routinely transfer personal data outside the United Kingdom. If circumstances require international transfer, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
Data Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest
- Regular security assessments and updates
- Access controls limiting who can view personal data
- Staff training on data protection principles
- Secure data backup procedures
Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.
Children's Data
Our services are not directed to children under 18. We do not knowingly collect or process personal data from children. If we become aware that we have inadvertently collected such data, we will delete it promptly.
Complaints
If you believe we have not handled your personal data in accordance with data protection law, you have the right to lodge a complaint with the supervisory authority.
In the United Kingdom, the supervisory authority is:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk
Updates to This Policy
We review our GDPR compliance practices regularly and may update this page to reflect changes in legislation or our processing activities. The date at the top of this page indicates when it was last updated.