Data protection rights and complaints.

Data protection law gives you rights over the personal information an organisation holds about you. This page explains each right, what it does and does not cover, and how to use it here.

What we collect and why is set out in the privacy notice. This page is about what you can do about it.

Exercising a right is free, and you do not have to give a reason for making a request.

Right of access

You can ask whether we hold personal information about you and, if we do, for a copy of it together with an explanation of what we use it for, who we share it with and how long we keep it. Where a copy would reveal information about another person, we may need to remove or redact that part.

Right to rectification

You can ask us to correct information about you that is inaccurate, and to complete information that is incomplete. If we disagree that something is inaccurate, we will tell you why, and we will record that you disputed it.

Right to erasure

You can ask us to delete information about you. This right applies in defined circumstances rather than universally: for example, we may need to keep information to meet a legal obligation, or to establish or defend a legal claim. Where we cannot delete something, we will tell you which exception applies.

Right to restrict processing

You can ask us to stop using information about you while something is being resolved — for instance while we check whether it is accurate, or while we consider an objection you have made. Restricted information is stored but not otherwise used.

Right to data portability

Where we hold information that you gave us, and we use it on the basis of your consent or under a contract with you, and we process it by automated means, you can ask for it in a structured, commonly used, machine-readable format, or ask us to send it to another organisation where that is technically possible.

Right to object

Where we rely on legitimate interests, you can object to our use of your information, and we must stop unless we can show compelling grounds that override your interests, or the information is needed for legal claims. Where we use information for direct marketing, an objection is absolute: we stop, without exception.

Rights relating to automated decision-making and profiling

You have rights where a decision that significantly affects you is made by automated means alone, including the right to ask for human involvement, to express your point of view, and to contest the decision. We do not currently make decisions in that way — trade-account applications are reviewed by a person — so in practice there should be nothing here to contest. If that ever changes, this page and the privacy notice will change with it.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawal does not affect anything done before you withdrew, and it does not stop us replying to an enquiry you made.

Right to complain

You can complain to us, and you can complain to the Information Commissioner’s Office. See below.

You can use the form further down this page, or write to us. Either route is equally valid; the form simply records a reference automatically.

It helps to tell us which right you are exercising and what the request relates to, but a request is valid however it is worded. Please do not send payment details or any information you would not want held in an email.

Before we act on a request we may need to be satisfied that you are who you say you are. This protects you: disclosing your information to someone impersonating you would be a breach in itself.

Where verification is needed we will ask for the minimum that will do the job, explain why we are asking, and use what you send only to check identity. If you are acting for someone else, we will also need evidence of your authority to do so. The time limit for responding does not start until we have what we reasonably need.

Data protection law sets time limits for responding to rights requests, and allows an extension in limited circumstances. The response timescale we publish as our own commitment, and the circumstances in which we would apply an extension, are [TO BE CONFIRMED: response timescale].

Requests are normally free. Where a request is manifestly unfounded or excessive, the law allows a reasonable fee to be charged or the request to be refused; if that ever applied we would explain why and tell you how to challenge it.

If you think we have handled your personal information badly, tell us. It is usually the fastest route to a fix, and it gives us the chance to put something right that we may not know about.

Use the form below and select Complaint, or write to our complaints contact. You will be given a reference, and the complaint is recorded with the status Received — awaiting review until a person has looked at it.

You have the right to complain to the Information Commissioner’s Office (ICO), the United Kingdom’s independent regulator for data protection.

You can do that at ico.org.uk, where the current contact routes and complaint process are published. You do not have to complain to us first, and complaining to us does not reduce your right to go to the ICO. Nothing on this page limits that right.

Whether we are required to register with the ICO and pay the data protection fee is [TO BE CONFIRMED: ICO registration].