Rights of individuals

Right to be informed

Individuals have the right to be informed about the collection and use of their personal data. Upon request, we will provide you with information including: the purposes for processing your personal data, our retention periods for that personal data and who it will be shared with.

Right of access

Individuals have the right to access their personal data and supplementary information free of charge (known as a Subject Access Request). The right of access allows individuals to be aware of and verify the lawfulness of our processing. Under the GDPR, individuals have the right to obtain confirmation that their data is being processed, access to their personal data and other supplementary information.

Right to rectification

Individuals have the right to have inaccurate personal data rectified. An individual may also request that incomplete personal data be completed.

Thames Reach will consider each request to have inaccurate or incomplete data rectified, whether requested in writing or verbally and will do everything in its power to accede to the request so long as it doesn’t relate to a subjective opinion or a mistake that has subsequently been rectified.

Where it is felt necessary to do so, Thames Reach will contact any third party that has received the inaccurate or incomplete data and inform them of the correction.

Right to erasure

Individuals have the right to have personal data erased, also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.

Individuals have the right to have their personal data erased if:

– the personal data is no longer necessary for the purpose for which it was originally collected

– the individual withdraws their consent, where consent is the lawful basis for holding the data

– where legitimate interests is the basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing

– processing is for direct marketing purposes and the individual objects

– processing is unlawful

Thames Reach can refuse to erase the data if it is required for a legal obligation, or for the establishment, exercise or defence of legal claims.

Right to restrict processing

Individuals have the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way that an organisation uses their data, for example, if they have issues with the content of the information or how it is processed. This is an alternative to requesting the erasure of their data.

Right to data portability

The right to data portability gives individuals the right to receive personal data they have provided to a controller in a structured, commonly used and machine readable format allowing them to reuse their personal data for their own purposes across different services.

The right only applies to information an individual has provided to a controller and only when the lawful basis for processing the information is ‘consent’ or ‘in the performance of a contract’ and the processing is carried out by electronic means (i.e. excluding paper files). It does not apply to anonymous data.

Right to object

Individuals have the right to object to processes based on legitimate interests or the performance of a task in the ’public interest’, direct marketing (including profiling) and processing for purposes of scientific/historical research and statistics.

Thames Reach will inform individuals of their right to object “at the point of first communication” and in our privacy notice.

Fees and timescales

In normal circumstances the above rights will be provided free of charge.

Where requests are manifestly unfounded or excessive, Thames Reach will consider whether a reasonable fee should be charged taking into account the administrative costs of undertaking the task. In extreme circumstances we may refuse to but will provide an explanation and inform the individual of their right to complain.

Information will be provided without delay and at the latest within one month of receipt of the request.