Last Updated: October 2024
Our Commitment to Data Protection
mist-yard is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the protection of your personal data seriously and have implemented appropriate measures to ensure your rights are respected.
Data Controller
mist-yard acts as the data controller for personal information collected through our website and services. This means we determine the purposes and means of processing your personal data and are responsible for ensuring compliance with data protection laws.
Contact details for our data controller:
mist-yard
47 Spinningfields Square
Manchester, M3 3JE
United Kingdom
Email: [email protected]
Your Data Protection Rights
Under the UK GDPR, you have the following rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request (SAR). We will respond to valid requests within one month.
Right to Rectification
You have the right to request that we correct any inaccurate personal data or complete any incomplete data we hold about you. We will action such requests without undue delay.
Right to Erasure
Also known as the "right to be forgotten," you may request the deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected, or when you withdraw consent upon which processing was based.
Right to Restrict Processing
You may request that we restrict the processing of your personal data in specific circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you oppose erasure.
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Upon objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently engage in such automated decision-making.
How to Exercise Your Rights
To exercise any of your data protection rights, please contact us using the details provided above. We may need to verify your identity before processing your request. There is generally no fee for exercising your rights, although we may charge a reasonable fee for manifestly unfounded or excessive requests.
Lawful Basis for Processing
We process personal data under one or more of the following lawful bases:
- Consent: Where you have given clear consent for us to process your personal data for specific purposes
- Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
- Legal Obligation: Where processing is necessary for us to comply with the law
- Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests
Data Security Measures
We have implemented appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
- Secure storage systems with access controls
- Regular security assessments and updates
- Staff training on data protection procedures
- Secure transmission of data where applicable
Data Breach Procedures
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also communicate the breach to you directly without undue delay.
International Data Transfers
Your personal data is primarily stored and processed within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the Information Commissioner's Office, or transfer to countries with adequacy decisions.
Supervisory Authority
If you believe we have not handled your personal data in accordance with data protection laws, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk
Updates to This Notice
We may update this GDPR compliance notice from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this notice periodically.