This policy applies to you, as a Data Subject, in relation to any of your personal data which is processed by us where we are the ‘Controller’. It sets out your rights under GDPR, and provides details on how we handle your rights. We will provide you with any relevant information you request in relation to your rights as soon as practicable, but in no event longer than 1 month of request. In order to do so we may request additional information from you for the purpose of identity verification. If we are not able to verify your identity then we may be exempt from the application of certain rights. If the request is complex or numerous we may take longer than 1 month (but no more than 2 months) to respond, but we will notify you within 1 month if we need such an extension.
Where we are the ‘Processor’ we will be subject to the instructions of the applicable ‘Controller’ and will assist you in referring your request to the relevant ‘Controller’. We will assist the Controller in responding to your request.