GDPR Compliance

Last updated: September 2024

1. Our Commitment to Data Protection

iris-manta is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the protection of personal data seriously and have implemented appropriate measures to ensure compliance with applicable data protection laws.

2. Data Controller Information

For the purposes of data protection legislation, iris-manta acts as a data controller in relation to the personal data we collect and process. Our contact details are:

iris-manta
47 Colmore Row
Birmingham B3 2BS
United Kingdom
Email: [email protected]

3. Principles of Data Processing

We process personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner.
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes and do not process it in a manner incompatible with those purposes.
• Data minimisation: We ensure that personal data is adequate, relevant, and limited to what is necessary.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
• Storage limitation: We retain personal data only for as long as necessary for the purposes for which it was collected.
• Integrity and confidentiality: We process data in a manner that ensures appropriate security.

4. Your Rights Under GDPR

Under data protection legislation, you have the following rights:

4.1 Right of Access

You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month of receiving it.

4.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

4.3 Right to Erasure

In certain circumstances, you have the right to request that we delete your personal data. This right is not absolute and may be subject to legal or contractual retention requirements.

4.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example, while we verify the accuracy of your data.

4.5 Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

4.6 Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

4.7 Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such automated decision-making.

5. Exercising Your Rights

To exercise any of your rights, please submit a request to [email protected]. We may need to verify your identity before processing your request. We will respond to valid requests within one month, though this period may be extended by a further two months for complex requests.

6. Lawful Bases for Processing

We rely on the following lawful bases for processing personal data:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal obligation: Where processing is necessary for compliance with a legal obligation.
• Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided these do not override your fundamental rights and freedoms.

7. Data Breach Procedures

We have procedures in place to detect, investigate, and report personal data breaches. In the event of a breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

8. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

9. Updates to This Information

We may update this GDPR compliance information from time to time. Any changes will be posted on this page with an updated revision date.