Legal
GDPR and your data rights
The rights you have over personal information we hold, how to exercise them, and what we will do when you ask.
Last updated: 5 September 2026
Who this GDPR notice applies to
The UK GDPR and the EU General Data Protection Regulation give people meaningful rights over information held about them. If you are in the United Kingdom or the European Economic Area and we hold personal information about you, this page explains what you can ask for.
We extend the same process to everyone who contacts us, wherever they are. It is simpler than deciding case by case, and fairer.
Who the controller is
BLAC-M is the data controller for information collected through blac-m.com. That means we determine why and how it is processed, and we are accountable for it.
BLAC-M
Dubai, United Arab Emirates
You can reach us about anything on this page through our contact form, or by email at privacy@blac-m.com.
What we process, and why
| What we process | Why | Legal basis |
|---|---|---|
| Name, email, phone, company, website, enquiry type, message | To answer your enquiry and discuss possible work | Pre-contract steps at your request; legitimate interests |
| Name, email, phone, discipline, portfolio link, CV, message | To consider your job application | Pre-contract steps at your request |
| Analytics data about site usage | To understand and improve the website | Your consent (withdrawable at any time) |
| IP address sent to Google when web fonts load | To display the site in its intended typefaces | Legitimate interests |
| Server logs and backups | Security, fault diagnosis and recovery | Legitimate interests |
Our Privacy Policy describes each of these in more detail.
Your rights in full
The right to be informed
To know what we collect and what we do with it. That is what these pages are for.
The right of access
To get a copy of the personal information we hold about you, and an explanation of how it is used.
The right to rectification
To have inaccurate information corrected and incomplete information completed.
The right to erasure
To have your information deleted where there is no overriding reason for us to keep it.
The right to restrict processing
To have us pause using your information – for example while a dispute about its accuracy is resolved.
The right to data portability
To receive information you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider.
The right to object
To object to processing based on legitimate interests. If you object, we must stop unless we can show compelling grounds that override your rights.
The right to withdraw consent
Where we rely on your consent – which on this site means analytics and nothing else – you can withdraw it at any time using the cookie settings link in our footer. Withdrawing does not affect anything done before you withdrew.
Rights around automated decisions
Not to be subject to decisions made purely by automated means with legal or similarly significant effects. We do not carry out automated decision-making or profiling, so this does not arise here.
How to make a request
Email privacy@blac-m.com, or use our contact form, and say clearly what you want – access, correction, deletion, or anything else above.
- There is no charge for a request.
- We respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you why within the first month.
- We may ask you to confirm your identity before releasing information, so that we do not disclose your data to someone else.
- If we cannot do what you ask, we will tell you why and what you can do next.
If you are not satisfied
Tell us first – most issues are quicker to fix directly. If you remain unhappy, you have the right to complain to the data protection supervisory authority in your country. In the United Kingdom that is the Information Commissioner’s Office; in the EEA it is your national data protection authority.
Complaining to a regulator does not affect your right to pursue a claim through the courts.
Who processes data on our behalf
We use third-party services to run the website and our email. Each processes personal information on our instructions:
- Web hosting – stores the website, its database, uploaded files and backups.
- Email delivery and mailbox – sends messages from the site and holds the enquiries we receive.
- Google – Google Analytics (only where you have accepted it), Google Fonts, which serves the typefaces and therefore receives your IP address when a page loads, PageSpeed Insights, which receives any address you submit to the website check field, and reCAPTCHA, which protects the two forms.
Some of these process data outside the UK and EEA. Where that happens, an appropriate safeguard such as standard contractual clauses or an adequacy decision must be in place. Ask us if you want detail on a specific service.
Data breaches
If a breach of personal data occurred that was likely to result in a risk to people’s rights, we would report it to the relevant supervisory authority within 72 hours of becoming aware of it. Where the risk was high, we would also tell the people affected directly and without undue delay.
The privacy policy describes what we collect and why. The cookies policy covers browser storage specifically.
Related pages
- Privacy Policy – what we collect, why, and how long we keep it.
- Cookies Policy – the exact cookies this site uses and how to switch them off.