Data Subject Access Request Form
Please complete the form below if you want us to supply you with a copy of any personal data we hold about you. You are currently entitled to receive this information under the EU General Data Protection Regulation (GDPR), which comes into effect on 25 May 2018. We will also provide you with information about any processing of your personal data that is being carried out, the retention periods which apply to your personal data, and any rights to rectification, erasure, or restriction of processing that may exist.
If a Subject Access Request (SAR) is received from a source where the individual’s identity has already been verified, then Conversion Works Limited will comply with that request within thirty (30) days of receipt and completely free of charge.
Where an individual’s identity needs to be verified, or where permission for a third-party making a request on behalf of another needs to be sought, or where it is not clear what the individual is seeking from their initial correspondence, Conversion Works Limited’s response correspondence will be sent without undue delay to request proof of identity/permission before progressing the request.
We may request additional information from you to help confirm your identity and your right to access, and to provide you with the personal data we hold about you. We reserve the right to refuse to act on your request if we are unable to identify you.
Where appropriate, Conversion Works Limited will respond to an individual upon receipt of their SAR, regardless of a need for further information in order to process the SAR, in order to confirm receipt and outline timeframes.
Certain SARs might not enter the process for a detailed response. Such requests will fall into one or more of the categories below and reasons will be communicated to the individual submitting the SAR. The categories are:
- The request requires excessive effort. Due to Conversion Works Limited’s small size and limited impact on individuals, requests that are likely to require more than sixty (60) minutes of the Data Protection Lead’s time to process (not including correspondence) will be deemed ‘excessive’;
- The request is unfounded. A SAR will be unfounded if a response confirming that no Personal Data is held or that the individual’s Personal Data has been erased or anonymised has been sent within the last ninety (90) days;
- The request is a duplicate/repetitive. The same, or materially similar SARs have been submitted by the same individual in the last ninety (90) days.
Conversion Works Limited may charge a reasonable administration fee for excessive or repetitive requests. This will be communicated in initial correspondence (with the payment options) and a SAR subject to a fee will only be progressed once payment has been received.
For more information on your rights under the GDPR, see please email firstname.lastname@example.org
Click here to download the form.