GDPR Compliance

Our GDPR Commitment

Moonlit Passage is fully committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take your data protection rights seriously and have implemented comprehensive measures to ensure the security and proper handling of your personal information.

Data Protection Principles

We adhere to the core principles of UK GDPR in all our data processing activities:

• Lawfulness, fairness, and transparency: We process data legally, fairly, and with clear communication about how we use it
• Purpose limitation: We collect data only for specified, explicit, and legitimate purposes
• Data minimization: We collect only the data necessary for our services
• Accuracy: We take reasonable steps to ensure data accuracy and keep it up to date
• Storage limitation: We retain data only as long as necessary for the purposes collected
• Integrity and confidentiality: We protect data with appropriate security measures
• Accountability: We can demonstrate our compliance with these principles

Your Data Protection Rights

Under UK GDPR, you have specific rights regarding your personal data. We are committed to facilitating the exercise of these rights:

Right to Be Informed

You have the right to clear information about how we collect and use your personal data. This information is provided in our Privacy Policy and at the point of data collection.

Right of Access

You can request a copy of the personal data we hold about you. We will respond to such requests within one month, free of charge. To make a request, contact us at [email protected].

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will respond to rectification requests within one month.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Note that this right is not absolute and may be limited by legal obligations, such as financial services record-keeping requirements.

Right to Restrict Processing

You can request that we limit how we use your data in certain situations, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us using the following details:

Email: [email protected]
Subject line: GDPR Request - [specify right you wish to exercise]
Postal address: 42 Harrington Gardens, London SW7 4JU, United Kingdom

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.

Data Protection Officer

For matters related to data protection, you can contact our designated data protection contact:

Email: [email protected]

Data Security Measures

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Staff training on data protection and security
• Incident response and data breach procedures
• Secure disposal of data when no longer needed

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach
• Inform affected individuals without undue delay if the breach poses a high risk
• Provide clear information about the nature of the breach and recommended steps to protect yourself

International Data Transfers

We primarily process data within the United Kingdom. If we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the UK government
• Standard contractual clauses approved by the ICO
• Binding corporate rules where applicable

Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

Record of Processing Activities

We maintain detailed records of our data processing activities as required by UK GDPR. These records include:

• Purposes of processing
• Categories of data subjects and personal data
• Recipients of personal data
• Data retention periods
• Security measures

Regular Reviews and Updates

We regularly review and update our data protection practices to ensure ongoing compliance with UK GDPR requirements. This includes:

• Annual data protection impact assessments
• Regular staff training updates
• Policy and procedure reviews
• Security measure audits

Complaints and Concerns

If you have concerns about how we handle your personal data or believe we have not complied with UK GDPR, please contact us first so we can address your concerns.

If you remain dissatisfied, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113
Website: moonlit-passage.com

Questions About GDPR Compliance

If you have questions about our GDPR compliance practices or would like more information about how we protect your data, please contact:

Email: [email protected]