moss-manta

GDPR Information

Last Updated: September 2026

General Data Protection Regulation Compliance

moss-manta is committed to complying with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page provides specific information about our GDPR compliance practices and your rights under this legislation.

Data Controller

moss-manta acts as the data controller for personal information collected through this website and in the course of providing our services.

Contact details:
moss-manta
45 Stafford Street
Edinburgh EH3 7BJ
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. Our processing activities rely on the following legal grounds:

Consent

When you provide explicit consent for us to process your personal information for specific purposes, such as receiving marketing communications or participating in surveys. You may withdraw consent at any time.

Contract Performance

Processing necessary to fulfil our contractual obligations to clients, including delivering consulting services, project management, and reporting.

Legitimate Interests

Processing that serves our legitimate business interests while respecting your fundamental rights and freedoms. This includes business development activities, improving our services, and maintaining security.

Legal Obligation

Processing required to comply with legal and regulatory requirements, such as tax reporting, financial record-keeping, and professional standards.

Your Rights Under GDPR

The GDPR grants you several rights regarding your personal information:

Right to Be Informed

You have the right to clear information about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR page.

Right of Access

You can request confirmation of whether we process your personal data and obtain copies of that data. We will provide this information free of charge within one month of your request.

Right to Rectification

If your personal information is inaccurate or incomplete, you have the right to request correction. We will update records promptly upon verification.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, including:

  • The data is no longer necessary for the purpose it was collected
  • You withdraw consent and no other legal basis exists for processing
  • You object to processing and no overriding legitimate grounds exist
  • The data has been unlawfully processed
  • Erasure is required for compliance with legal obligations

This right is not absolute and may be limited by other legal obligations or legitimate interests.

Right to Restrict Processing

You can request that we limit how we use your personal information in certain situations:

  • You contest the accuracy of the data while we verify it
  • Processing is unlawful but you prefer restriction over erasure
  • We no longer need the data but you require it for legal claims
  • You have objected to processing while we verify legitimate grounds

Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you can request a copy of your data in a structured, commonly used, and machine-readable format. You may also request direct transfer to another organisation where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Upon receiving an objection to marketing, we will cease such processing immediately. For other objections, we will assess whether compelling legitimate grounds override your interests.

Rights Related to Automated Decision-Making

You have rights regarding decisions made solely through automated processing that produce legal or similarly significant effects. We do not currently engage in automated decision-making of this nature.

Exercising Your Rights

To exercise any of these rights, please contact us using the details provided above. We will:

  • Respond to your request within one month
  • Verify your identity before processing requests
  • Provide information free of charge unless requests are manifestly unfounded or excessive
  • Explain our reasons if we refuse a request

Data Protection Principles

We adhere to the GDPR's core data protection principles:

Lawfulness, Fairness, and Transparency

We process data lawfully, fairly, and transparently, providing clear information about our practices.

Purpose Limitation

We collect personal data for specified, explicit, and legitimate purposes and do not process it in ways incompatible with those purposes.

Data Minimisation

We collect only personal data that is adequate, relevant, and limited to what is necessary for the intended purposes.

Accuracy

We take reasonable steps to ensure personal data is accurate and kept up to date. Inaccurate data is erased or rectified without delay.

Storage Limitation

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by legal obligations.

Integrity and Confidentiality

We implement appropriate security measures to protect personal data against unauthorised or unlawful processing and accidental loss, destruction, or damage.

Accountability

We demonstrate compliance with these principles through documentation, policies, and procedures.

Data Security Measures

We implement technical and organisational security measures appropriate to the risk, including:

  • Encryption of data in transit and at rest
  • Access controls and authentication systems
  • Regular security assessments and updates
  • Staff training on data protection
  • Incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

International Data Transfers

We process personal data primarily within the United Kingdom. If we transfer data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as:

  • Adequacy decisions recognising equivalent data protection standards
  • Standard contractual clauses approved by regulatory authorities
  • Other legally recognised transfer mechanisms

Complaints and Supervisory Authority

If you believe we have not complied with GDPR requirements, you may lodge a complaint with us first. We will investigate and respond to your concerns.

You also have the right to lodge a complaint directly with the supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: ico.org.uk

Updates to This Information

We may update this GDPR information periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website. Please review this page regularly to stay informed about our data protection practices.

Further Information

For additional details about how we collect, use, and protect personal information, please refer to our Privacy Policy.