GDPR Compliance
Last updated: June 15, 2026
Data Controller
For the purposes of the General Data Protection Regulation (GDPR), the data controller is sepia-moss, located at 42 Deansgate, Manchester M3 2BA, United Kingdom.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Consent: You have given explicit consent for processing your personal data for specific purposes
- Legitimate interests: Processing is necessary for our legitimate business interests
- Legal obligation: Processing is necessary to comply with legal requirements
Data We Collect
We collect and process the following categories of personal data:
- Identity data: name and contact details
- Contact data: email address
- Service data: information about the services you request
- Technical data: IP address, browser type, and device information
Your Rights Under GDPR
Under the GDPR, you have the following rights:
Right to Access
You have the right to request copies of your personal data from us.
Right to Rectification
You have the right to request correction of any information you believe is inaccurate or incomplete.
Right to Erasure
You have the right to request deletion of your personal data under certain conditions.
Right to Restrict Processing
You have the right to request restriction of processing of your personal data under certain conditions.
Right to Data Portability
You have the right to request transfer of your data to another organization or directly to you under certain conditions.
Right to Object
You have the right to object to our processing of your personal data under certain conditions.
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
Data Security
We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
International Data Transfers
Your personal data is stored and processed within the United Kingdom. If data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with GDPR requirements.
Exercising Your Rights
To exercise any of your rights under GDPR, please contact us at [email protected]. We will respond to your request within one month.
Complaints
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).