Privacy Rights Request

Use this channel to exercise rights under applicable law, including GDPR, the CCPA as amended, and the VCDPA. Submission does not create a right where law does not apply, but every request will be reviewed in good faith.

Last updated: 10 August 2026

Who can submit a request?

• Anyone whose personal data we may process
• People protected by UK, EEA or applicable US state privacy law
• A legal representative or authorised agent with proof of authority
• A business customer's user; we may route the request to that controlling customer

Your rights may include:

• Confirmation, knowledge, and access
• Correction of inaccurate data
• Deletion subject to lawful retention and exceptions
• Restriction, objection, and withdrawal of consent
• Portability where applicable
• Opt-out of sale, sharing, targeted advertising, or profiling where applicable
• Limit certain sensitive-information uses in California
• Information and human intervention for solely automated decisions where provided
• No discrimination for exercising rights

How to submit a request

Send your request by email including:

• Full name and email linked to the account
• Country and state only to identify applicable law
• Requested right and related product or business
• For agents, proof of authority and any required confirmation
• Do not initially send identity documents; we request them only if needed

privacy-rights.email

Verification and fees

Verification will be proportionate to risk and requested data. We use only what is necessary and do not require an account. If authentication is not possible, we will explain and may request more information.

Requests are ordinarily free. We may charge reasonable cost or decline manifestly unfounded, excessive, or repetitive requests only where law permits and after explaining why.

Response timeframe

• UK GDPR and EU GDPR: one month; complex requests may be extended by two further months with notice during the first
• California: acknowledgement and response within CCPA periods; verifiable requests normally within 45 days and extended where permitted
• Virginia: 45 days, extendable once by 45 days with reasons
• We respond sooner where possible and explain any refusal

Appeals

In Virginia and where appeal is legally available, reply requesting review. In Virginia we decide within 60 days. If denial is upheld, we explain how to contact the relevant authority.

Complaints to authorities

People in the UK may complain to the Information Commissioner's Office. People in the EEA may complain to the authority where they live, work or an alleged infringement occurred. US residents may contact the regulator or attorney general identified by applicable state law. Contacting us first is not required.

Controller information