Last Updated: July 8, 2026
mesa-whale is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take your data protection rights seriously and have implemented comprehensive measures to ensure your personal information is processed lawfully, fairly, and transparently.
mesa-whale acts as the data controller for personal information collected through our services. We determine the purposes and means of processing your personal data.
Contact Details:
mesa-whale
Baltic Quarter
Liverpool L1 0AH
United Kingdom
Email: [email protected]
The UK GDPR grants you specific rights regarding your personal data:
You have the right to clear, transparent information about how we use your personal data. This information is provided through our Privacy Policy and this GDPR statement.
You can request copies of your personal data. We will provide this information free of charge within one month of your request. If your request is complex or numerous, we may extend this period by two months, and we will inform you of this extension.
If you believe any personal data we hold about you is inaccurate or incomplete, you can request correction. We will correct inaccurate data within one month.
Also known as the "right to be forgotten," this allows you to request deletion of your personal data in certain circumstances, including:
You can request that we limit how we use your personal data in specific situations:
You can request a copy of your personal data in a commonly used, machine-readable format. This applies when processing is based on consent or contract performance and is carried out by automated means.
You can object to processing of your personal data where we rely on legitimate interests as the legal basis. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
You have rights regarding automated decision-making processes. Currently, mesa-whale does not use automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of these rights, contact us at [email protected] with the subject line "GDPR Request." Please include:
We will respond to your request within one month. In complex cases, we may extend this to three months and will notify you of any extension.
We process personal data based on one or more of the following lawful bases:
For detailed information about what personal data we collect and how we use it, please refer to our Privacy Policy.
We have implemented appropriate technical and organizational security measures to protect your personal data, including:
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach. We will also notify the Information Commissioner's Office (ICO) as required by law.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Our retention periods vary depending on the type of data:
When we engage third-party service providers who process personal data on our behalf, we ensure they:
We primarily process data within the United Kingdom. If we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:
If you believe we have not complied with GDPR requirements, you can lodge a complaint with us at [email protected]. We take all complaints seriously and will investigate thoroughly.
You also have the right to lodge a complaint directly with the supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: www.ico.org.uk
We may update this GDPR compliance statement to reflect changes in our data processing practices or legal requirements. We will post any changes on this page with an updated revision date.
For any questions about our GDPR compliance or data protection practices, contact us at [email protected] with the subject line "Data Protection Inquiry."