You have certain rights under data protection laws, which we summarise below. If you contact us about these rights, we may ask for proof of your identity before we act on any request, and we may refuse to act if you do not provide this or your identity is not established by you. This is to ensure that your data is protected and kept secure. More information about your rights and our obligations can be found on https://ico.org.uk/.

To exercise any of your rights below, please use a dedicated online form, or send your request via email to compliance@rchmail.com.

You may request the following information be provided to you:

whether we are processing personal data about you;
what personal data we are processing, including a request for a copy of your data;
what purposes we are processing data for;
from which sources we have collected the data;
who we disclose the data to;

We will act within one month after receiving a valid request (i.e. when we will have been able to identify you as the data subject). If your request is complex, or if we have a high volume of requests, we may extend this period for two additional months. We will advise you if this is the case.

The law does allow us, in certain cases, to refuse to act upon your request or to charge a reasonable administration fee, if we estimate that the request is manifestly unfounded or excessive. We will advise you at the time if this is the case along with your possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

15.1 Rectification

You have the right to have your personal data amended if it is inaccurate or incomplete.

15.2 Right to object

You have the right to object to the use of your personal information for direct marketing or where we use it on the basis that we say we have a legitimate interest in using it.

15.3 Erasure

You have the right to have your personal information deleted or removed in the following circumstances:

The data is no longer necessary for the purpose for which it was originally collected or otherwise processed;
Where you withdraw your consent, where consent was used as the legal basis for processing;
Personal data has been unlawfully processed;
When you object to the processing and we have no overriding legitimate interest for continuing the processing;
Erasure is required for compliance with a legal requirement; or
Data has been collected in relation to the offering of online services to a child.
When a request for erasure is valid, we will take reasonable steps to inform third parties which are processing the personal data that you have requested us to delete.

We have the right to refuse to act on a request of erasure if the data is necessary for:

Exercising the right of freedom of expression and information;
Compliance with a legal obligation;
The establishment, exercise or defence of legal claims;

15.4 Portability

You have the right to receive your personal data which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller, when:

the processing is based on consent or on a contract; and
the processing is carried out by automated means.

15.5 Restrict Processing

You have the right to obtain from us the restriction of processing of your personal data where one of the following applies:

You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;

The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
We no longer need the personal data for the purposes of the processing, but the data is necessary for you for the establishment, exercise or defence of legal claims;
You have objected to processing pending the verification whether our legitimate grounds override yours.

Where the processing of your personal data is restricted, at the exception of storage, we will only process your personal data with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another individual or organisation, or because we are legally required to do so.

We will inform you before the restriction of processing is lifted.

15.6 Right to withdraw your consent

You are free to withdraw your consent at any time, where we rely on your consent as a legal basis for processing. Please contact us using the details outlined in Section 16 of this policy. See also section 10.3 for details as to how to object to our direct marketing communications.

15.7 Right to lodge a complaint with a supervisory authority

The laws we comply with are regulated by the Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, or call 03031231113 and online at https://ico.org.uk/make-a-complaint/ and for other member states, the independent supervisory authority responsible for monitoring the application of the regulation]. In addition to your rights above, it is open to you, if you have a complaint or a concern, to seek assistance from this supervisory authority who has powers to compel us to comply with applicable laws and fine us for non-compliance. However, before you do so, we would hope that you will contact us first to discuss any complaint or concerns you have. You can contact us using the details provided in Section 16 of this our privacy notice.

15.8 Changes to this privacy policy

We keep our privacy notice under regular review to make sure it is up to date and accurate. When we make any change, we will notify you by email of such change. You can check the top of the document to see the latest version in force.

15.9 Applicable Law and Disputes

Our privacy policy is subject to the law of Scotland and disputes can be determinted by the courts of Scotland.