GDPR Notice
Last updated: November 2, 2026
This GDPR Notice explains how Hayzell collects, uses, and protects the personal data of people in the European Economic Area (“EEA”) and the United Kingdom (“UK”) when they visit or use this website and related services (the “Services”), and how to exercise your rights under the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.
For the purposes of applicable data protection law, Hayzell is the “controller” of your personal data. If you have any questions about this notice or how we handle your personal data, you can contact us at [email protected]. This notice supplements our Privacy Policy; where this notice conflicts with the Privacy Policy in respect of EEA or UK data subjects, this notice controls.
Personal Data We Process
“Personal data” means any information relating to an identified or identifiable person. We process the following categories of personal data, depending on how you interact with the Services:
- Contact data — such as your email address when you sign up to our mailing list or contact us.
- Usage and device data — such as your IP address, browser type, device type, and how you interact with the Services, collected automatically when you visit the website.
- Communications data — such as the content of messages you send to us, for example when you contact us with an inquiry.
How and Why We Process Your Personal Data (Lawful Bases)
We only process personal data where we have a valid lawful basis under Article 6 of the GDPR. The bases we rely on are:
Consent (Art. 6(1)(a)). Where you have given clear consent — for example, when you sign up to receive marketing emails. You can withdraw your consent at any time, as described below, without affecting the lawfulness of processing carried out before withdrawal.
Legitimate interests (Art. 6(1)(f)). Where processing is necessary for our legitimate interests — such as operating, maintaining, and securing the Services, and understanding how the website is used — provided these interests are not overridden by your rights and freedoms.
Legal obligation (Art. 6(1)(c)). Where processing is necessary to comply with a legal obligation applicable to us, such as retaining records required by law.
Cookies and Similar Technologies
The Services currently use only strictly necessary cookies or equivalent technologies required for the website to function. We do not place analytics, advertising, or other non-essential cookies on your device without your prior consent. If this changes, we will ask for your consent before doing so and update this notice.
Marketing Communications
We only send marketing emails where you have opted in. Every marketing email includes an unsubscribe link, and you can opt out at any time by using that link or by emailing us at [email protected]. If you opt out, we will stop sending you marketing communications, but may still contact you about non-marketing matters.
International Data Transfers
We are based outside the EEA and UK, and our service providers may process personal data in countries other than yours. Where personal data is transferred out of the EEA or UK, we rely on recognised safeguards such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, unless the destination country has been found to provide an adequate level of protection. You may contact us for more information about the safeguards we use.
Data Retention
We keep personal data only for as long as necessary for the purposes described in this notice, including to satisfy legal, accounting, or reporting requirements. If you unsubscribe from our mailing list, we retain your email address on a suppression list so that we can respect your opt-out request.
Your Rights Under the GDPR
Subject to certain conditions and exceptions, if you are in the EEA or UK you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to request that inaccurate or incomplete personal data be corrected.
- Right to erasure — to request that we delete your personal data in certain circumstances.
- Right to restrict processing — to ask us to pause processing of your personal data in certain circumstances.
- Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
- Right to object — to object to processing based on our legitimate interests, or to processing for direct marketing (which we will always honour).
- Right to withdraw consent — where processing is based on consent, to withdraw it at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request (extendable for complex requests as permitted by law). We may need to verify your identity before responding. You will not have to pay a fee, and we will not discriminate against you for exercising your rights.
Right to Lodge a Complaint
If you have concerns about how we process your personal data, please contact us first so we can try to resolve them. You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country of residence or place of work.
Changes to This Notice
We may update this notice from time to time to reflect changes in our practices or legal requirements. We will post the revised notice on this page and update the “Last updated” date above.
Contact
If you have any questions about this notice or our handling of your personal data, please email us at [email protected].