GDPR Compliance Statement

Last Updated: July 13, 2026

Our Commitment to Data Protection

marsh-myth is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This document outlines our approach to data protection and your rights as a data subject.

Data Controller Information

marsh-myth acts as the data controller for personal information collected through our website and services. We determine the purposes and means of processing your personal data.

Data Controller:
marsh-myth
47 Berkeley Square
Mayfair
London W1J 5AT
United Kingdom
Email: [email protected]

Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. The primary legal bases we rely on are:

Contract Performance

Processing is necessary to perform our contract with you, including:

• Processing booking requests
• Confirming rental arrangements
• Providing vehicle hire services
• Managing your account and rental history

Legitimate Interests

Processing is necessary for our legitimate business interests, such as:

• Improving our services and website functionality
• Preventing fraud and maintaining security
• Analyzing business performance
• Direct marketing to existing clients (where not objected to)

Consent

We obtain your explicit consent for specific processing activities, including:

• Use of non-essential cookies
• Marketing communications to new prospects
• Any processing not covered by other lawful bases

Legal Obligation

Processing required to comply with legal requirements, such as:

• Tax and accounting obligations
• Responding to lawful requests from authorities
• Maintaining records as required by law

Your Rights Under GDPR

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format within one month of your request.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will respond to such requests within one month.

Right to Erasure

You may request deletion of your personal data in the following circumstances:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required to comply with a legal obligation

Right to Restriction of Processing

You may request that we restrict processing of your personal data in certain situations:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing based on consent before withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, please submit a request to [email protected] with the following information:

• Your full name
• Your email address
• Specific right you wish to exercise
• Any relevant details to help us locate your information

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will notify you of any such extension.

Data Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication requirements
• Staff training on data protection principles
• Incident response procedures
• Regular backups and disaster recovery planning

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Clients: For the duration of the business relationship
• Former Clients: Seven years after the last transaction for legal and accounting purposes
• Marketing Data: Until consent is withdrawn or two years of inactivity
• Website Analytics: 26 months from collection

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in risk to individuals.

International Data Transfers

We primarily store and process data within the United Kingdom. Any transfers outside the UK are conducted in accordance with GDPR requirements, utilizing appropriate safeguards such as:

• Standard contractual clauses approved by the UK authorities
• Adequacy decisions recognizing equivalent data protection
• Binding corporate rules where applicable

Third-Party Processing

We engage carefully selected third-party processors to assist with our operations. All processors are required to:

• Process data only on our documented instructions
• Implement appropriate security measures
• Maintain confidentiality
• Assist with responding to data subject rights requests
• Delete or return data upon termination of services

Privacy by Design

We incorporate data protection principles into our operations from the design stage, implementing measures such as:

• Data minimization: collecting only necessary information
• Purpose limitation: using data only for specified purposes
• Storage limitation: retaining data only as long as necessary
• Integrity and confidentiality: protecting data against unauthorized access

Children's Data

Our services are not directed at children under 18 years of age. We do not knowingly collect or process personal data from children. If we become aware of such collection, we will take immediate steps to delete the information.

Automated Decision-Making

We do not employ automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

Complaints

If you believe we have not handled your personal data in accordance with GDPR requirements, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom
Website: ico.org.uk

Updates to This Statement

We review and update this GDPR compliance statement regularly to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website with an updated "Last Updated" date.