GDPR Information

Last Updated: November 3, 2026

Introduction to GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It establishes strict requirements for how organizations collect, process, store, and protect personal data of individuals in the European Union and European Economic Area.

Verse-nebula is committed to full compliance with GDPR principles and regulations. This page explains how we honor your rights and protect your data under GDPR.

Data Controller Information

For the purposes of GDPR, Verse-nebula acts as the data controller for personal information collected through our website and services.

Entity Name: Verse-nebula
Registered Address: 17 Queensway Terrace, Bristol BS8 1HJ, United Kingdom
Contact Email: [email protected]

Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so under GDPR Article 6. Our processing activities rely on the following legal bases:

Consent (Article 6(1)(a))

When you submit forms on our website, accept cookies, or opt-in to communications, we rely on your explicit consent. You have the right to withdraw this consent at any time.

Contract Performance (Article 6(1)(b))

Processing is necessary to fulfill service requests, coordinate travel experiences, and communicate with you about bookings.

Legitimate Interests (Article 6(1)(f))

We may process data based on legitimate interests, such as improving our services, preventing fraud, and ensuring network security. We carefully balance these interests against your rights and freedoms.

Legal Obligations (Article 6(1)(c))

We process certain data to comply with legal and regulatory requirements, including tax laws, financial regulations, and anti-money laundering obligations.

Your Rights Under GDPR

Right to Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about how it is processed.

Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete data.

Right to Erasure / Right to be Forgotten (Article 17)

You may request deletion of your personal data in certain circumstances, including:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and no other legal basis exists
• You object to processing and no overriding legitimate grounds exist
• The data has been unlawfully processed
• Legal obligations require erasure

Note that we may be required to retain certain data for legal or regulatory compliance.

Right to Restriction of Processing (Article 18)

You can request that we restrict processing of your personal data when:

• You contest the accuracy of the data
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you require it for legal claims
• You have objected to processing pending verification of legitimate grounds

Right to Data Portability (Article 20)

You have the right to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller.

Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Article 22)

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.

How to Exercise Your Rights

To exercise any of your GDPR rights, please submit a request by email to [email protected] with "GDPR Request" in the subject line. Include:

• Your full name
• The email address associated with your data
• Specific right you wish to exercise
• Any relevant details to help us locate your data

We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of the extension and reasons.

Data Protection Principles

We adhere to the GDPR data protection principles (Article 5), ensuring that personal data is:

• Processed lawfully, fairly, and transparently: We clearly communicate our processing activities
• Collected for specified, explicit, and legitimate purposes: We only collect data necessary for defined purposes
• Adequate, relevant, and limited: We minimize data collection to what is necessary
• Accurate and kept up to date: We take steps to ensure data accuracy
• Kept no longer than necessary: We implement appropriate retention periods
• Processed securely: We employ appropriate security measures

International Data Transfers

When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Other legally recognized transfer mechanisms

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR Article 34. We will also notify the relevant supervisory authority within 72 hours as required by Article 33.

Data Protection Officer

While we are not required to appoint a Data Protection Officer under GDPR, all data protection inquiries are handled by our dedicated privacy team. Contact us at [email protected] with any concerns.

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in your country of habitual residence, place of work, or place of alleged infringement.

For the United Kingdom, the relevant authority is:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

Children's Data

We do not knowingly process personal data of children under 16 years of age without parental consent, in accordance with GDPR Article 8.

Updates to This Information

We may update this GDPR information page to reflect changes in regulations or our practices. Significant changes will be communicated through our website or via email.

Additional Resources

For more information about how we collect and use personal data, please refer to our Privacy Policy.