GDPR Compliance

Last Updated: September 1, 2026

Our Commitment to Data Protection

magenta-moss is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: Processing necessary to provide our card protection services
• Legitimate Interests: Fraud detection and prevention activities
• Consent: Marketing communications and optional data processing
• Legal Obligation: Compliance with financial regulations and law enforcement requests

Your GDPR Rights

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information within one month of your request.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure

You have the right to request deletion of your personal data under certain circumstances. Note that we may be required to retain some data for legal compliance.

Right to Restrict Processing

You can request that we limit how we use your data in specific situations.

Right to Data Portability

You can request your data in a structured, commonly used format for transfer to another service provider.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of these rights, contact us at: [email protected]

We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months.

Data Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security assessments and audits
• Staff training on data protection
• Incident response procedures

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

International Data Transfers

Your data is primarily stored within the European Economic Area. If we transfer data outside the EEA, we ensure appropriate safeguards are in place through standard contractual clauses or adequacy decisions.

Data Protection Officer

For data protection inquiries, contact our team at: [email protected]

Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data properly.

UK supervisory authority: Information Commissioner's Office (ICO)
Website: ico.org.uk

Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children.