Privacy Policy

1. Data Controller and Scope

Yard and Paper (hereinafter "we", "us", or "our") operates as the Data Controller in respect of the personal data collected through this website. Based in London, United Kingdom, we are committed to processing your personal data in strict accordance with the **UK General Data Protection Regulation (UK GDPR)**, the **Data Protection Act 2018 (DPA 2018)**, and the **Privacy and Electronic Communications Regulations 2003 (PECR)**.

This policy applies to all visitors, users, and others who access our services, specifically those seeking technical analysis and information regarding Canadian credit consultation services.

2. Categories of Data Collected

We may collect and process the following types of information:

• Identity Data: Includes first name, last name, or similar identifiers provided via contact forms.
• Contact Data: Includes email address, telephone numbers, and physical address.
• Technical Data: Includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Usage Data: Includes information about how you use our website, products, and services.
• Marketing and Communications Data: Includes your preferences in receiving marketing from us and our third parties and your communication preferences.

3. Legal Basis for Processing

Under the UK GDPR, we rely on the following lawful bases for processing your personal data:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to a newsletter).
• Contractual Necessity: Where the processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legal Obligation: Where the processing is necessary for us to comply with the law (not including contractual obligations).
• Legitimate Interests: Where the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

4. Data Retention and Security

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

5. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• Request access to your personal data (commonly known as a "data subject access request").
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data where there is no good reason for us continuing to process it.
• Object to processing of your personal data where we are relying on a legitimate interest.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data.

6. Third-Party Transfers

We may share your personal data with external third parties (e.g., service providers acting as processors, professional advisers including lawyers, auditors and insurers). If we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• Transferring data to countries that have been deemed to provide an adequate level of protection for personal data.
• Using specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

7. Contact Information

If you have any questions about this privacy policy or our privacy practices, please contact our Data Protection Officer:

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.