GDPR Compliance

Last updated: January 2024

Our Commitment to GDPR

merry-deer is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we meet our obligations and how you can exercise your data protection rights.

Data Controller

merry-deer acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing personal data.

Contact details:
Email: [email protected]
Address: 14 Queensgate House, Redcliffe Way, Bristol BS1 6NL

Lawful Basis for Processing

We process personal data under the following lawful bases as defined by Article 6 of the UK GDPR:

• Consent: Where you have provided explicit consent to process your data for specific purposes
• Contract: Where processing is necessary to perform our contractual obligations or pre-contractual steps at your request
• Legitimate Interests: Where processing serves our legitimate business interests without overriding your fundamental rights
• Legal Obligation: Where processing is required to comply with applicable laws and regulations

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Access

You may request a copy of the personal data we hold about you. We will respond to valid requests within one month.

Right to Rectification

You may request correction of inaccurate or incomplete personal data. We will make corrections without undue delay.

Right to Erasure

You may request deletion of your personal data where there is no compelling reason for continued processing. This right is subject to legal retention requirements.

Right to Restrict Processing

You may request limitation of processing in certain circumstances, such as while we verify the accuracy of contested data.

Right to Data Portability

You may request your data in a structured, commonly used, machine-readable format for transfer to another controller.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently use automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We may request proof of identity before processing requests. There is no fee for most requests, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

Data Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure server infrastructure with encryption
• Access controls limiting data access to authorised personnel
• Regular security assessments and updates
• Staff training on data protection obligations

Data Breach Procedures

In the event of a personal data breach, we will:

• Assess the risk to individuals affected
• Notify the Information Commissioner's Office within 72 hours where required
• Inform affected individuals without undue delay where there is high risk
• Document all breaches and remedial actions

International Data Transfers

Personal data is primarily processed within the United Kingdom. Any transfers outside the UK are subject to appropriate safeguards such as standard contractual clauses or adequacy decisions.

Supervisory Authority

If you are unsatisfied with our response to a data protection concern, you have the right to lodge a complaint with the Information Commissioner's Office:

Website: ico.org.uk
Telephone: 0303 123 1113

Updates to This Information

We review our GDPR compliance procedures regularly and will update this page to reflect any changes. The revision date at the top indicates when this information was last reviewed.