GDPR Compliance

Last Updated: September 1, 2026

Overview

Moon-roam is committed to compliance with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals in the European Economic Area. This document outlines how we handle personal data in accordance with GDPR requirements.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you voluntarily submit information through our forms or communication channels
• Contract Performance: To provide services you have requested or entered into agreement for
• Legitimate Interests: To improve our services and maintain business operations
• Legal Obligations: To comply with applicable laws and regulations

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request confirmation of whether we process your personal data and obtain a copy of that data.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You can request that we limit the processing of your personal data in specific situations.

Right to Data Portability

You can request to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.

Right to Object

You can object to processing of your personal data where we rely on legitimate interests as the legal basis.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Data Protection Principles

We adhere to GDPR data protection principles:

• Processing personal data lawfully, fairly, and transparently
• Collecting data for specified, explicit, and legitimate purposes
• Ensuring data is adequate, relevant, and limited to what is necessary
• Maintaining accurate and up-to-date data
• Retaining data only as long as necessary
• Processing data securely with appropriate technical measures

Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission or transfers to countries with adequacy decisions.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: [email protected]
Address: 42 Northbrook Street, Reading, Berkshire, RG1 7DA, United Kingdom

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months and will inform you accordingly.

Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with GDPR requirements. In the United Kingdom, this is the Information Commissioner's Office (ICO).

Data Protection Officer

For questions specifically related to data protection and GDPR compliance, you may contact our data protection representative at [email protected].