Your information and concerns
A clear way to make a request or complaint
You can contact us to exercise a right over your personal data or to complain about how we have handled it. You do not need to use legal wording or complete a special form.
1
Your data protection rights
Depending on the circumstances, you may have the right to:
request access to the personal data we hold about you;
ask us to correct inaccurate or incomplete personal data;
request deletion of your personal data in certain circumstances;
ask us to restrict how we use your personal data in certain circumstances;
object to processing where we rely on legitimate interests;
request data portability where applicable;
withdraw consent where we rely on consent; and
complain to the Information Commissioner’s Office.
Not every right applies in every situation.
For example, we may need to retain certain information for legal, accounting, tax or record-keeping purposes.
2
How to make a request
To exercise any of your data protection rights, please email:
Email: letstalk@thegdprstudio.co.uk
Subject line: Privacy Request
Email is the simplest way for us to receive, track and respond to your request. You do not need to complete a particular form or quote data protection law.
3
What to include in your request
Please include enough information for us to understand your request and locate the relevant personal data.
Your full name.
The email address or contact details you have used with us.
The right you would like to exercise.
Enough detail about the information, service, booking, resource or communication involved.
Relevant dates or reference details, where available.
You do not need a form or legal wording.
We will only use the information you provide to verify, manage and respond to your request.
4
Identity checks
We may need to verify your identity before responding to a request, particularly where the request involves access to, deletion of or changes to personal data.
Any identity check will be reasonable, proportionate and limited to what is necessary to protect your information from unauthorised access.
5
Response times
We will usually respond without undue delay and within one month of receiving your request.
If we reasonably need further information to verify your identity, we will ask for it promptly. The response timeframe begins once we have received the information reasonably required to confirm your identity.
Where a request is complex or you have made multiple requests, the response period may be extended by up to two further months.
If an extension applies, we will let you know within the initial one-month period and explain why.
6
Fees and requests we cannot fully meet
Data-rights requests are usually free.
However, where a request is manifestly unfounded or excessive, or where you request additional copies of information already provided, we may charge a reasonable administrative fee or refuse to act on the request where permitted by law.
We may also need to limit or refuse part of a request where a legal exemption applies, where responding would disclose another person’s personal data, or where we are required to retain information for legal reasons.
If we cannot fully comply with your request, we will explain why and tell you about your right to complain to the ICO.
7
Make a data protection complaint
If you believe we have not handled your personal data properly or complied with data protection law, you can make a data protection complaint directly to us. This is separate from making a data rights request.
Email: letstalk@thegdprstudio.co.uk
Subject line: Data Protection Complaint
Please explain what has happened, when it happened and what you would like us to do. If possible, include any relevant correspondence or reference numbers. You do not need to quote the law or use legal wording.
What happens after you complain
We will acknowledge your complaint within 30 days of receiving it. This does not mean that the investigation must be completed within 30 days.
We will take appropriate steps to investigate the complaint without undue delay.
We may ask you for further information or verify your identity or authority where necessary.
We will keep you informed of progress while the investigation is ongoing.
We will tell you the outcome without undue delay and explain any action we have taken or propose to take.
Complaining to the ICO
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.
Information Commissioner’s Office
Website:
ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
8
Contact details
Please use the subject line that matches the reason you are contacting us so that we can identify and manage it correctly.
The GDPR Studio Ltd
Suite A, 82 James Carter Road, Mildenhall, IP28 7DE
Email: letstalk@thegdprstudio.co.uk
Data rights request subject line: Privacy Request
Complaint subject line: Data Protection Complaint
