GDPR Information

Last updated: July 13, 2026

Our Commitment to Data Protection

We take your privacy seriously and are committed to protecting your personal data in accordance with the General Data Protection Regulation and other applicable data protection laws. This page provides specific information about how we comply with GDPR requirements.

Data Controller

For the purposes of GDPR, the data controller is:

onyx-moss
47 Wellington Street
Leeds, West Yorkshire, LS1 4JN
United Kingdom

Legal Bases for Processing

We process your personal data only when we have a legal basis to do so. Our legal bases include:

• Consent: When you have given clear consent for us to process your personal data for specific purposes
• Contract: When processing is necessary to fulfill a contract we have with you or to take steps at your request before entering into a contract
• Legal obligation: When we must process your data to comply with the law
• Legitimate interests: When processing is necessary for our legitimate interests or those of a third party, provided your rights do not override those interests

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You can request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format.

Right to Rectification

If you believe the personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You can request that we limit how we use your personal data in certain situations, such as while we verify the accuracy of data you have contested.

Right to Data Portability

You have the right to receive your personal data in a portable format and to transmit it to another data controller where technically feasible.

Right to Object

You can object to processing of your personal data where we rely on legitimate interests as our legal basis. You also have an absolute right to object to processing for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently use automated decision-making processes.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected] or write to us at the address provided above. We will respond to your request within one month, though this may be extended by two additional months if your request is complex.

We may need to verify your identity before processing your request to protect your personal data from unauthorized access.

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Specific retention periods depend on the nature of the data and the purposes for processing.

International Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission or adequacy decisions.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office, the UK's supervisory authority for data protection issues.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113

Updates to This Information

We may update this GDPR information from time to time. Any changes will be posted on this page with an updated revision date.