How We Protect Your Personal Data
Individuals have a right to make a ‘subject access request’ to gain access to personal information that the company holds about them. This includes:
Confirmation that their personal data is being processed
Access to a copy of the data
The purposes of the data processing
The categories of personal data concerned
Who the data has been, or will be, shared with
How long the data will be stored for, or if this isn’t possible, the criteria used to determine this period
The source of the data, if not the individual
Whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual
Subject access requests must be submitted in writing, either by letter or email to your line manager. They should include:
Name of individual
Correspondence address
Contact number and email address
Details of the information requested
When responding to requests, we:
May ask the individual to provide 2 forms of identification
May contact the individual via phone to confirm the request was made
Will respond without delay and within 1 month of receipt of the request
Will provide the information free of charge
May tell the individual we will comply within 3 months of receipt of the request, where a request is complex or numerous. We will inform the individual of this within 1 month, and explain why the extension is necessary
If the request is unfounded or excessive, we may refuse to act on it, or charge a reasonable fee which takes into account administrative costs. A request will be deemed to be unfounded or excessive if it is repetitive or asks for further copies of the same information. When we refuse a request, we will tell the individual why, and tell them they have the right to complain to the ICO.
Other data protection rights of the individual: In addition to the right to make a subject access request (see above), and to receive information when we are collecting their data about how we use and process it, individuals also have the right to:
Withdraw their consent to the processing at any time
Ask us to rectify, erase or restrict processing of their personal data, or object to the processing of it (in certain circumstances)
Prevent the use of their personal data for direct marketing
Challenge processing which has been justified on the basis of public interest
Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect them)
Prevent processing that is likely to cause damage or distress
Be notified of a data breach in certain circumstances
Make a complaint to the ICO
Ask for their personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances)
Consent:
I have read and consent to my personal data, as detail above, being held and utilised by Sunlight Care Group or the purposes stated.