GDPR Compliance

Last updated: September 1, 2026

Our Commitment to Data Protection

opal-mesa.com is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: When you provide explicit consent for specific processing activities
• Contract: When processing is necessary to fulfill our service agreement with you
• Legitimate Interests: When we have a legitimate business interest, such as improving our services
• Legal Obligation: When required by law

Data Controller Information

The data controller responsible for your personal information is:

opal-mesa.com
52 Clerkenwell Road
Islington
London EC1M 5PX
United Kingdom
Email: [email protected]

Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data under certain circumstances, including when it is no longer necessary for the purposes for which it was collected.

Right to Restrict Processing

You may request that we limit the processing of your personal data in specific situations.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and transmit it to another controller.

Right to Object

You can object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Active client data: Duration of business relationship plus 6 years
• Inquiry data: 2 years from last contact
• Website analytics: 26 months

International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom. If we transfer data outside the UK or EEA, we ensure appropriate safeguards are in place.

Data Security

We implement appropriate technical and organizational measures to ensure data security, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Staff training on data protection

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk

Updates to This Statement

We may update this GDPR compliance statement periodically. Material changes will be communicated to you via email or prominent notice on our website.