Your data protection rights under GDPR and UK data protection law
merry-fell is committed to protecting your personal data and respecting your privacy. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights and how we fulfil our obligations as a data controller.
merry-fell is the data controller responsible for your personal data. Our contact details are:
merry-fell
47 Castle Street
Liverpool, L2 9UB
Email: [email protected]
Under data protection law, you have the following rights:
You have the right to be informed about the collection and use of your personal data. Our Privacy Policy provides this information, explaining what data we collect, how we use it, and who we share it with.
You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond to valid requests within one month.
You have the right to request that we correct any inaccurate personal data we hold about you. You can also request that we complete any incomplete data.
You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or if you withdraw consent.
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transfer this data to another organisation.
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes.
You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently use automated decision-making in ways that affect you.
To exercise any of your data protection rights, please contact us using the details above. We may need to verify your identity before processing your request. We aim to respond to all legitimate requests within one month. If your request is complex or we receive a high volume of requests, we may extend this by up to two months, in which case we will notify you.
We process personal data under the following lawful bases:
We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods vary depending on:
When data is no longer needed, it is securely deleted or anonymised.
When arranging travel, we may need to transfer your personal data to countries outside the UK. Such transfers are made in compliance with data protection law, using appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first.
We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.
Last updated: January 2024