GDPR Compliance
Last updated: 3rd November 2026
Our Commitment to GDPR
True-spring is committed to full compliance with the General Data Protection Regulation (GDPR). This page explains how we uphold your data protection rights under GDPR and UK data protection law.
Data Controller Information
True-spring Cartography acts as the data controller for personal information collected through this website and our business operations.
Our contact details:
True-spring Cartography
142 Redchurch Street
London E2 7EN
United Kingdom
Email: [email protected]
Lawful Basis for Processing
We process personal data only when we have a lawful basis to do so:
Contractual Necessity: When you place an order, we must process your name, email, and shipping address to fulfill our contractual obligations.
Legitimate Interests: We analyze aggregated website usage data to improve our services. This processing does not override your fundamental rights and freedoms.
Legal Obligation: We retain certain records to comply with accounting, tax, and consumer protection laws.
Consent: For optional activities like marketing emails, we only proceed with your explicit consent, which you may withdraw at any time.
Your GDPR Rights
Under GDPR, you have comprehensive rights regarding your personal data:
Right of Access
You can request confirmation of what personal data we hold about you and receive a copy of that data. We will provide this within one month of your request.
Right to Rectification
If personal data we hold is inaccurate or incomplete, you have the right to have it corrected. We will update our records promptly upon verification.
Right to Erasure
You may request deletion of your personal data when it is no longer necessary for the purpose it was collected, or when you withdraw consent. Note that legal obligations may require us to retain certain information.
Right to Restrict Processing
You can request that we limit how we use your data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability
You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another service provider.
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
How to Exercise Your Rights
To exercise any of these rights, send a request to [email protected] with:
Your full name and the email address associated with your account or order.
A clear description of which right you wish to exercise.
Any relevant details that help us locate your data quickly.
We will respond within one month. If your request is complex or we receive multiple requests, we may extend this by two months, in which case we will inform you and explain the reason for the delay.
Data Protection Principles
We adhere to the core GDPR principles when processing personal data:
Lawfulness, Fairness, and Transparency: We process data legally, fairly, and transparently as described in our Privacy Policy.
Purpose Limitation: We collect data for specific, explicit purposes and do not process it in ways incompatible with those purposes.
Data Minimization: We only collect data that is necessary for the stated purposes.
Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
Storage Limitation: We retain data only as long as necessary for the purposes for which it was collected or to meet legal obligations.
Integrity and Confidentiality: We implement appropriate security measures to protect against unauthorized or unlawful processing and accidental loss, destruction, or damage.
Data Breach Notification
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also inform affected individuals without undue delay.
Third-Party Processors
We engage third-party service providers who process personal data on our behalf (such as shipping carriers and payment processors). These processors are contractually bound to process data only according to our instructions and to maintain appropriate security measures.
International Transfers
We primarily process data within the United Kingdom. Any transfers outside the UK or EEA are protected by appropriate safeguards, such as standard contractual clauses approved by regulatory authorities.
Supervisory Authority
You have the right to lodge a complaint with the supervisory authority if you believe we have not complied with GDPR requirements:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk
Updates to This Statement
We review our GDPR compliance regularly and update this page as necessary. Material changes will be communicated to registered users via email.