GDPR Compliance
Last Updated: September 8, 2026
Our Commitment to GDPR
moon-jay is committed to compliance with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals within the European Economic Area and the United Kingdom.
Data Controller Information
moon-jay acts as the data controller for personal information collected through our website and services.
Contact Details:
moon-jay
42 Wellington Street
Leeds, LS1 4JJ
United Kingdom
Email: [email protected]
Your Rights Under GDPR
Right to Access
You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data, along with information about how it is processed.
Right to Rectification
You may request correction of inaccurate personal data and completion of incomplete personal data concerning you.
Right to Erasure
Under certain circumstances, you have the right to request deletion of your personal data. This right is not absolute and applies only in specific situations outlined by GDPR.
Right to Restriction of Processing
You may request that we restrict processing of your personal data under certain conditions, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability
You have the right to receive personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR.
How to Exercise Your Rights
To exercise any of these rights, submit a written request to [email protected]. We will respond to your request within one month, though this period may be extended by two additional months when necessary, considering the complexity and number of requests.
We may require verification of your identity before processing requests to ensure data security and prevent unauthorized disclosure.
Legal Basis for Processing
We process personal data only when we have a valid legal basis:
- Consent: You have given clear consent for processing for specific purposes
- Contract: Processing is necessary for a contract with you
- Legal Obligation: Processing is necessary to comply with legal requirements
- Legitimate Interests: Processing is necessary for legitimate interests pursued by us or a third party, except where overridden by your rights
Data Retention Periods
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.
- Consultation requests: 7 years
- Business correspondence: 7 years
- Website analytics data: 26 months
- Cookie data: As specified in our Cookies Policy
Data Security Measures
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of personal data in transit and at rest
- Regular security assessments and updates
- Access controls and authentication procedures
- Staff training on data protection principles
- Incident response procedures
Data Breach Notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you without undue delay, and where feasible, within 72 hours of becoming aware of the breach.
International Data Transfers
When we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place, such as:
- Standard contractual clauses approved by the European Commission
- Adequacy decisions recognizing equivalent protection in the destination country
- Other legally approved transfer mechanisms
Automated Decision-Making
We do not engage in automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.
Changes to This Statement
We may update this GDPR compliance statement to reflect changes in our data processing practices or legal requirements. Material changes will be communicated through our website.
Contact and Questions
For questions about our GDPR compliance or to exercise your rights, contact us at [email protected] or write to the address listed above.