Last Updated: July 6, 2026
rugombrci.com is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations as a data controller and explains your rights under current data protection legislation.
For the purposes of UK data protection legislation, the data controller is:
rugombrci.com
127 Colmore Row
Birmingham
B3 3AG
United Kingdom
Email: [email protected]
We process personal data only when we have a lawful basis to do so. The primary legal bases we rely on are:
When you engage our services, we process your personal data to fulfill our contractual obligations, including preparing and submitting benefits applications, maintaining client records, and providing consultation services.
Certain data processing activities are necessary to comply with legal requirements, including maintaining client records for professional indemnity purposes and responding to lawful requests from regulatory authorities.
In specific circumstances, we seek your explicit consent before processing certain categories of data, particularly sensitive personal data such as health information. You may withdraw consent at any time by contacting us.
We may process data based on legitimate business interests, such as improving service quality, preventing fraud, and maintaining website security. We conduct assessments to ensure such processing does not override your fundamental rights and freedoms.
Depending on the nature of your engagement with us, we may process:
Under UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of receiving your request, free of charge for the first copy.
If you believe any personal data we hold about you is inaccurate or incomplete, you may request correction. We will respond to your request within one month.
In certain circumstances, you may request deletion of your personal data. This right is not absolute and may be limited by legal or professional obligations to retain certain records.
You may request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of the data or object to our processing.
Where we process your data based on consent or contract performance, and the processing is automated, you have the right to receive your data in a structured, commonly used format and to transmit that data to another controller.
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
We implement comprehensive technical and organisational measures to protect personal data:
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk, we will also inform affected individuals without undue delay.
We primarily process data within the United Kingdom. Should we transfer data outside the UK, we will ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or other legally approved mechanisms.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, accounting, or reporting requirements. Our standard retention period for client records is seven years following service completion, in line with professional indemnity requirements.
Where we engage third-party service providers to process personal data on our behalf, we ensure:
Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children without appropriate parental or guardian consent.
To exercise any of your data protection rights, please contact us at [email protected]. We may request proof of identity to verify your request and will respond within one month, or two months for complex requests.
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
We review this GDPR compliance notice regularly and update it as necessary to reflect changes in our data processing activities or legal requirements. The date of the last update appears at the top of this page.