General Data Protection Regulation Compliance
fern-myth is committed to full compliance with the General Data Protection Regulation (GDPR) and other applicable data protection legislation. This page outlines how we meet our obligations and protect your rights under GDPR.
Data Controller Information
For the purposes of GDPR, fern-myth acts as the data controller for personal information collected through our website and business operations.
Contact details:
Email: [email protected]
Address: 42 Merrion Square, Dublin 2, Ireland
Lawful Basis for Processing
We process personal data only when we have a lawful basis to do so. The lawful bases we rely on include:
Consent
When you submit a contact form or inquiry, you provide explicit consent for us to process your personal information to respond to your request. You may withdraw this consent at any time by contacting us.
Legitimate Interests
We may process certain data based on our legitimate business interests, such as:
- Analyzing website usage to improve user experience
- Maintaining security of our systems
- Developing and improving our services
Legal Obligation
We may process data when required to comply with legal obligations, such as responding to lawful requests from authorities.
Your Rights Under GDPR
Under GDPR, you have comprehensive rights regarding your personal data:
Right to Be Informed
You have the right to clear information about how we collect and use your personal data. This information is provided in our Privacy Policy and on this page.
Right of Access
You can request a copy of the personal data we hold about you. We will provide this information within one month of your request.
Right to Rectification
If your personal data is inaccurate or incomplete, you have the right to have it corrected or completed.
Right to Erasure
Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes it was collected.
Right to Restrict Processing
You can request that we limit how we use your personal data in certain situations, such as when you contest the accuracy of the data.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to Object
You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision Making
You have rights regarding automated decision-making and profiling. We do not currently engage in automated decision-making that produces legal or similarly significant effects.
How to Exercise Your Rights
To exercise any of your GDPR rights, please contact us at [email protected]. When submitting a request, please include:
- Your full name
- The email address associated with your inquiry
- A clear description of which right you wish to exercise
- Any relevant details to help us locate your data
We will respond to your request within one month. In complex cases, we may extend this period by an additional two months, and we will inform you of any such extension.
Data Protection Principles
We adhere to the following data protection principles as required by GDPR:
- Lawfulness, fairness, and transparency: We process data lawfully and are transparent about our practices
- Purpose limitation: We collect data for specified, explicit purposes and do not process it in ways incompatible with those purposes
- Data minimization: We collect only the data necessary for our purposes
- Accuracy: We take steps to ensure personal data is accurate and up to date
- Storage limitation: We retain data only as long as necessary
- Integrity and confidentiality: We implement appropriate security measures to protect data
- Accountability: We take responsibility for compliance and can demonstrate our adherence to these principles
Data Security Measures
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption of data in transit and at rest
- Regular security assessments and updates
- Access controls and authentication procedures
- Staff training on data protection practices
- Incident response procedures
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights, we will also notify you directly.
International Data Transfers
When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as:
- Standard contractual clauses approved by the European Commission
- Adequacy decisions confirming sufficient data protection in the destination country
- Other legally recognized transfer mechanisms
Supervisory Authority
You have the right to lodge a complaint with a supervisory authority if you believe we have not complied with GDPR. In Ireland, the relevant authority is:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Updates to This Page
We may update this GDPR compliance information from time to time to reflect changes in our practices or legal requirements. We encourage you to review this page periodically.
Questions and Contact
If you have questions about our GDPR compliance or data protection practices, please contact us at [email protected].