Your rights over the personal data under our control

The UK GDPR provides the following rights to individuals:

  • Right to be informed: We have to tell you why, what, how, and with whom we share your personal information.
  • Right of access: You may demand to see your personal information under our control.
  • Right of rectification: If for any reason your personal information under our control is not accurate, you have the right to have it updated.
  • The right to erasure: Under certain circumstances, you can instruct us to erase your personal information. If this right applies to the particular processing, we will have to delete your personal information from our systems.
  • Right to restrict processing: Sometimes, you might want us to suspend processing for a limited period. For example, you may want us to hold on to your data even after the retention period expires, because you envisage a need for it. Our data protection officer will let you know whether your instruction to restrict processing was upheld or not and why.
  • Right to data portability: If you require your personal data to be sent to another controller, or you would like a copy for yourself, this right allows you to request it from us in a digital format.
  • Right to object: When we use legitimate interest as our lawful basis for processing, it cannot be used to override your interests. If we use this lawful basis, you have the right to object to the processing.
  • Rights in relation to automated decision making and profiling: If we use systems that make decisions without human intervention, you may have the right to request for the processing to be carried out in whole or in part by a living person. There are restrictions to exercising this right. One such restriction is when we are processing your personal data with the intent to enter into a contract with you.
  • Right to withdraw consent: If we required your consent before processing your personal data, you have the right to withdraw that consent at anytime during processing.

When you exercise any of these rights, we refer to your action as a data subject access request (DSAR). You can make a DSAR through any avenue where we interact with you and collect your personal data.