Subject Access Request

This document sets out the CALGAVIN^® Ltd policy for responding to “subject access requests” under data protection legislation.

This document sets out the CALGAVIN Ltd policy for responding to “subject access requests”under data protection legislation.

A subject access request is a written request for personal information (known as personal data) held about you by CALGAVIN Ltd. Generally, you have the right to see what personal information we hold about you.

The GDPR gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. However, this right is subject to certain exemptions.

The GDPR works in two ways. Firstly, it states that anyone who processes personal data must comply with six principles, which make sure that personal data is:

• fairly and lawfully processed
• processed for specific, explicit and legitimate purposes
• relevant and limited to what is necessary
• accurate and up to date
• not kept for longer than is necessary
• kept secure

Secondly, it provides individuals with important rights, including the right to find out what personal data is held on computer and most paper records.

Personal data will cover basic details and will include details such as name, address, telephone number and information held about that person in files, etc.

When we receive a subject access request we will first check that we have enough information to be sure of your identity. Often we will have no reason to doubt a person’s identity, for example, if we have regularly corresponded with them. However, if we have good cause to doubt your identity we can ask you to provide any evidence we reasonably need to confirm your identity.

We will gather any manual or electronically held information (including emails) and identify any information provided by a third party or which identifies a third party.

If we have identified information that relates to third parties, we will write to them asking whether there is any reason why this information should not be disclosed. We do not have to supply the information to you unless the other party has provided their consent or it is reasonable to do so without their consent. If the third party objects to the information being disclosed we may seek legal advice on what we should do.

We will deal with your subject access request without undue delay and in any event within one month of receipt of your request. However, if the work involved is particularly complex or if numerous requests are made then we extend this period by up to two additional months. In this case, we will inform you about the extension and explain the reasons.

We will not charge a fee for dealing with your request unless it is manifestly unfounded or excessive. If we charge a fee, we will inform you of this and explain the reasons for doing so.

We will explain what steps have been taken in dealing with your request i.e. we will set out the source of your personal information we have gathered.

The information will be provided in a concise, transparent and easily accessible form. It may be provided in writing, or by other means, including, where appropriate, by electronic means.

There are a number of exemptions to our duty to disclose personal data and we may seek legal advice if we consider that they might apply. An example of an exemption is information covered by legal professional privilege.

If we agree that the information is inaccurate, we will correct it and where practicable, destroy the inaccurate information. If we do not agree or feel unable to decide whether the information is inaccurate, we will make a note of the alleged error and keep this on file.

If you are not satisfied by our actions, you can seek recourse through our internal complaints procedure. If you remain dissatisfied, you have the right to refer the matter to the Information Commissioner or seek recourse through the courts.

 

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF, UK

Tel: 0303 123 1113 (local rate) or +44 (0)1625 545 745

 

If you would like to know more or have any concerns about how your personal data is being processed please contact:

CALGAVIN Ltd
Minerva Mill,
Station Road
Alcester
B49 5ET, UK

 

Subject Access Request

This document sets out the CALGAVIN^® Ltd policy for responding to “subject access requests” under data protection legislation.

This document sets out the CALGAVIN Ltd policy for responding to “subject access requests”under data protection legislation.

A subject access request is a written request for personal information (known as personal data) held about you by CALGAVIN Ltd. Generally, you have the right to see what personal information we hold about you.

The GDPR gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. However, this right is subject to certain exemptions.

The GDPR works in two ways. Firstly, it states that anyone who processes personal data must comply with six principles, which make sure that personal data is:

• fairly and lawfully processed
• processed for specific, explicit and legitimate purposes
• relevant and limited to what is necessary
• accurate and up to date
• not kept for longer than is necessary
• kept secure

Secondly, it provides individuals with important rights, including the right to find out what personal data is held on computer and most paper records.

Personal data will cover basic details and will include details such as name, address, telephone number and information held about that person in files, etc.

When we receive a subject access request we will first check that we have enough information to be sure of your identity. Often we will have no reason to doubt a person’s identity, for example, if we have regularly corresponded with them. However, if we have good cause to doubt your identity we can ask you to provide any evidence we reasonably need to confirm your identity.

We will gather any manual or electronically held information (including emails) and identify any information provided by a third party or which identifies a third party.

If we have identified information that relates to third parties, we will write to them asking whether there is any reason why this information should not be disclosed. We do not have to supply the information to you unless the other party has provided their consent or it is reasonable to do so without their consent. If the third party objects to the information being disclosed we may seek legal advice on what we should do.

We will deal with your subject access request without undue delay and in any event within one month of receipt of your request. However, if the work involved is particularly complex or if numerous requests are made then we extend this period by up to two additional months. In this case, we will inform you about the extension and explain the reasons.

We will not charge a fee for dealing with your request unless it is manifestly unfounded or excessive. If we charge a fee, we will inform you of this and explain the reasons for doing so.

We will explain what steps have been taken in dealing with your request i.e. we will set out the source of your personal information we have gathered.

The information will be provided in a concise, transparent and easily accessible form. It may be provided in writing, or by other means, including, where appropriate, by electronic means.

There are a number of exemptions to our duty to disclose personal data and we may seek legal advice if we consider that they might apply. An example of an exemption is information covered by legal professional privilege.

If we agree that the information is inaccurate, we will correct it and where practicable, destroy the inaccurate information. If we do not agree or feel unable to decide whether the information is inaccurate, we will make a note of the alleged error and keep this on file.

If you are not satisfied by our actions, you can seek recourse through our internal complaints procedure. If you remain dissatisfied, you have the right to refer the matter to the Information Commissioner or seek recourse through the courts.

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF, UK

Tel: 0303 123 1113 (local rate) or +44 (0)1625 545 745

If you would like to know more or have any concerns about how your personal data is being processed please contact:

CALGAVIN Ltd
Minerva Mill, Station Road
Alcester
B49 5ET, UK