GDPR Compliance

Last Updated: July 13, 2026

Our Commitment to Data Protection

mist-gate complies with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 in all data processing activities. This document explains how we meet our obligations and respect your rights.

Data Controller Information

Data Controller: mist-gate
Address: Unit 7, Broad Street Business Park, Birmingham B1 2HF, United Kingdom
Contact: [email protected]

Lawful Basis for Processing

We process personal data under the following lawful bases:

Contract Performance

Processing necessary to execute and manage vehicle rental agreements, including:

• Booking confirmation and management
• Vehicle allocation and preparation
• Payment processing
• Rental documentation

Legal Obligations

Processing required to comply with:

• Transport and vehicle rental regulations
• Insurance verification requirements
• Financial record-keeping obligations
• Tax reporting requirements

Legitimate Interests

Processing for our business operations, including:

• Fraud prevention and security
• Business analytics and improvement
• Internal record-keeping
• Legal defense

Your Data Protection Rights

Right of Access

You may request a copy of the personal data we hold about you. We will provide this within one month of receiving a valid request.

Right to Rectification

If personal information is inaccurate or incomplete, you have the right to request correction. We will update records promptly upon verification.

Right to Erasure

You may request deletion of your personal data in certain circumstances, including:

• Data no longer necessary for original purpose
• Withdrawal of consent (where consent was the basis)
• Objection to processing with no overriding legitimate grounds
• Data processed unlawfully

This right is subject to legal obligations requiring retention, such as financial record-keeping requirements.

Right to Restriction of Processing

You may request we limit processing of your data when:

• Accuracy of data is contested
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification

Right to Data Portability

For data processed based on consent or contract, you have the right to receive your data in a structured, commonly used format and transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any data protection right:

1. Send a request to [email protected]
2. Clearly state which right you wish to exercise
3. Provide information to help us verify your identity
4. Specify the data or processing you are referring to

We will respond within one month. For complex requests, we may extend this by two months and will inform you if this is necessary.

Data Security Measures

We implement appropriate technical and organizational measures to ensure data security:

Technical Measures

• Encrypted data transmission
• Secure password protocols
• Regular security updates and patches
• Access logging and monitoring

Organizational Measures

• Staff training on data protection
• Access controls limiting data access to necessary personnel
• Confidentiality agreements with staff and processors
• Regular review of data processing activities

Data Breach Procedures

In the event of a data breach likely to result in risk to your rights and freedoms:

• We will notify the Information Commissioner's Office within 72 hours of becoming aware
• We will inform affected individuals without undue delay
• Notification will describe the nature of the breach, likely consequences, and measures taken

International Data Transfers

We process and store data within the United Kingdom. If data transfers outside the UK become necessary, we will ensure appropriate safeguards are in place as required by UK GDPR.

Third-Party Processors

When engaging third-party processors, we ensure:

• Written contracts are in place
• Processors provide sufficient guarantees of appropriate technical and organizational measures
• Processors only process data according to our documented instructions
• Confidentiality commitments are established

Data Protection Impact Assessments

We conduct data protection impact assessments for processing activities that pose high risks to individual rights and freedoms.

Complaints

If you believe we have not complied with data protection law, you may:

1. Contact us directly at [email protected] to resolve the issue
2. Lodge a complaint with the Information Commissioner's Office:
   Website: ico.org.uk
   Telephone: 0303 123 1113

Updates to This Document

We review and update this GDPR compliance statement regularly to reflect changes in our practices or legal requirements. Significant changes will be highlighted on this page.