Under the GDPR and Data Protection Act 2018, you have the following rights regarding your personal data:

10.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process your personal data and, if so, to request access to that data, together with certain additional information (such as the purposes of processing and categories of data).

10.2 Right to Rectification (Article 16 GDPR)

You have the right to have inaccurate personal data corrected and incomplete personal data completed.

10.3 Right to Erasure (“Right to be Forgotten”) (Article 17 GDPR)

You have the right to request the deletion of your personal data in certain circumstances, including:

• • Where the data is no longer necessary for the purposes for which it was collected
  • Where you withdraw consent (and there is no other legal basis for processing)
  • Where you object to processing and there are no overriding legitimate grounds
  • Where the data has been unlawfully processed
  • Where erasure is necessary to comply with a legal obligation

This right is not absolute and may be subject to exemptions (e.g., where we are required to retain data for legal compliance).

10.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict processing of your personal data in certain circumstances, including:

• • Where you contest the accuracy of the data (until we verify its accuracy)
  • Where processing is unlawful, but you do not want the data erased
  • Where we no longer need the data, but you require it to establish, exercise, or defend legal claims
  • Where you have objected to processing (pending verification of our legitimate grounds)

10.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

10.6 Right to Object (Article 21 GDPR)

You have the right to object to:

• • Processing based on legitimate interests: You may object at any time, and we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims.
  • Direct marketing: You have an absolute right to object to processing for direct marketing purposes at any time. We will cease such processing immediately upon receipt of your objection.

10.7 Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

10.8 Right Not to Be Subject to Automated Decision-Making (Article 22 GDPR)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. We do not currently engage in automated decision-making.

10.9 Exercising Your Rights

To exercise any of the above rights, please contact us using the details in Section 2. We may request specific information from you to verify your identity and ensure that your personal data is not disclosed to unauthorised parties.

We will respond to your request without undue delay and, in any event, within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension and the reasons for delay.

There is no fee for exercising your rights, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.