GDPR Compliance Statement

Last updated: 13 July 2026

Our Commitment

As a UK-based business, we comply with the General Data Protection Regulation and UK Data Protection Act 2018. This page outlines how we fulfill our obligations as a data controller.

Legal Basis for Processing

We process personal data under the following legal bases:

• Contract: Processing is necessary to fulfill rental agreements and booking arrangements
• Legal obligation: We retain certain records as required by UK business and tax regulations
• Legitimate interests: We process data to prevent fraud and maintain business records

Data Controller Information

The data controller for information collected through this website is:
umber-breeze.com
42 Marylebone High Street
London W1U 5HD
United Kingdom

Categories of Personal Data

We collect and process the following types of personal information:

• Contact details: name, email address
• Rental preferences: vehicle selection, rental dates
• Verification data: driving license information, insurance details
• Payment information: processed through third-party payment providers

Data Retention

Personal data is retained according to these timelines:

• Enquiry data without completed booking: 12 months
• Completed rental records: 7 years (UK business record requirements)
• Marketing preferences: until withdrawal of consent

Your GDPR Rights

You have the following rights regarding your personal data:

Right to Access

Request a copy of personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your data, subject to legal retention requirements.

Right to Restrict Processing

Request limitation of how we use your data.

Right to Data Portability

Receive your data in a structured, machine-readable format.

Right to Object

Object to processing based on legitimate interests.

Exercising Your Rights

To exercise any of these rights, contact us at: [email protected]

We will respond to requests within one month. Complex requests may require up to three months, and we will inform you if an extension is necessary.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR.

Supervisory Authority

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

International Data Transfers

Personal data is stored and processed within the United Kingdom. We do not transfer data outside the UK or EEA.

Automated Decision Making

We do not use automated decision-making or profiling systems that produce legal effects concerning you.