GDPR & your data rights

• Access — a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — deletion where there is no overriding legal reason to keep it.
• Restriction — limit how we use your data.
• Portability — receive your data in a machine-readable format.
• Objection — including to direct marketing, at any time.
• Automated decisions — we do not make decisions with legal effect solely by automated means.

Email dpo@yo-ho-no.com with your name, the email you use with us and what you are asking for. We may ask for proof of identity. We respond within one month (extendable by two months for complex requests). Requests are free unless manifestly unfounded or excessive.

We are controller for website, enquiry, introduction-service and executive-search data. Where a client instructs us and uploads data about third parties to a data room, we may act as processor under a Data Processing Agreement, available on request from legal@yo-ho-no.com.

We use vetted providers for cloud hosting, database, email delivery, e-signature and data sourcing, each bound by data processing terms. A current list is available on request.

Suspected security incidents are reported to the ICO within 72 hours where required, and affected individuals are informed without undue delay where there is a high risk.

Please contact our DPO first. You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF (ico.org.uk), or your EU supervisory authority.