You have the following rights in relation to the personal data we hold about you:
access – you can ask us for a copy of any personal information that we hold about you. If you require additional copies of the data, we may charge an administrative fee;
corrections – we use reasonable efforts to update the personal information we hold about you, but you can request that we amend any inaccurate or incomplete personal data that we hold;
restriction – you can request that we suspend the processing of your personal data where, for example, you object to our processing of it (see below) or while we correct any inaccuracies;
objection – you can tell us that you object to the processing of your personal data where, for example, we are using it for direct marketing purposes, or we are processing it on the grounds of “legitimate interests” (see above) and you feel it impacts your rights. If we feel we have a compelling reason to carry on this processing we will let you know, otherwise we will no longer use it for that purpose;
withdrawal of consent – where you have given us your consent to process your personal data for a particular purpose (or purposes), you can withdraw this permission at any time by letting us know;
deletion – we use reasonable efforts to delete your data when we no longer need it (see “How long do you hold personal data for?” above). However, you can also ask us to delete your personal data from our records in certain circumstances – for example, where you have withdrawn your consent for us to use it (see above). If we are unable to comply with your request for legal reasons, we will tell you this; and
transfer – you can ask for any personal data you have previously provided to us to be transferred to you in a usable electronic format, or to a third party (where this is technically feasible), so you can use it elsewhere.
When you make a request, we may request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We try to respond to all legitimate requests within one month, unless your request is particularly complex or you have made a number of requests, in which case it may take longer. If this is the case, we will keep you updated.