Data protection and privacy rights

Your right 

What does it mean? 

Limitations and conditions of your right 

Right to access 

Subject to certain conditions, you are entitled to access your personal data (this is also known as a “data subject access request.”). You may also be able to access the personal information we have collected about you, the categories of sources from which the information was collected, the purposes of collecting the information, the categories of third parties we have shared the information with, and the categories of personal information that have been shared with third parties for a business purpose. 

If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations.

Under certain laws we may refuse a data subject access request depending on the circumstances of the request. For example, access may not be provided where: 

• the burden or expense of providing access would be disproportionate to the risks to you, the requester; 
• the rights or interests of an individual other than you would be violated, such as where access would reveal another individual’s personal data;
• access would reveal information which we have taken steps to protect from disclosure because disclosure would help a competitor in the market (Confidential Commercial Information), such as where Confidential Commercial Information cannot be readily separated from the personal data;
• the execution or enforcement of the law, including prevention, investigation or detection of offences or the right to a fair trial would be interfered with;
• an investigation or grievance proceeding being conducted by us would be prejudiced; 
• any confidentiality that may be necessary for limited periods in connection with our management of our workforce (e.g. succession planning and corporate re-organizations; or in connection with monitoring, inspections, or regulatory functions connected with sound economic or financial management);
• a court, or other authority of appropriate jurisdiction, determines that we are not required to provide access; 
• a legal or other professional privilege or obligation would be breached; or 
• there is no legal requirement for us to provide such access, including because local legal requirements for a valid data subject access request have not been met.  

We may charge an administrative fee to you where the data subject access request is excessive or significantly unfounded (limited to the actual cost required to provide access to the requested personal data in the required format). 

Right to data portability 

Subject to certain conditions, you are entitled to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format. 

If you exercise this right, you should specify the type of information you would like to receive (and where we should send it) where possible to ensure that our disclosure is meeting your expectations. 

This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (i.e. not for paper records). It covers only the personal data that has been provided to us by you. 

Right in relation to inaccurate personal or incomplete data 

You may challenge the accuracy or completeness of your personal data and have it corrected or completed, as applicable. You have a responsibility to help us to keep your personal data accurate and up to date. 

We encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details, telephone number, immigration status. 

Please always check first whether there are any available self-help tools to correct the personal data we process about you. 

This right only applies to your own personal data. When exercising this right, please be as specific as possible. 

Right to object to or restrict our data processing 

Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your personal data. 

This right applies where our processing of your personal data is necessary for our legitimate interests. You can also object to our processing of your personal data for direct marketing purposes. 

Right to erasure 

Subject to certain conditions, you are entitled to have your personal data erased (also known as the “right to be forgotten”), e.g. where your personal data is no longer needed for the purposes it was collected for; where the relevant processing is unlawful, or there is an applicable law requiring erasure of the personal data; or where you have exercised a legitimate right to object to processing of your personal data. 

We may not be in a position to erase your personal data, if for example: 

• we need it to comply with a legal obligation; 
• we need it to exercise or defend legal claims; 
• we need it to exercise freedom of expression and information; 
• we need it to carry out a task in the “public interest”; 
• we need it to archive personal data in the public interest, or for scientific, historical, or statistical research purposes if those purposes would be seriously impaired by the erasure of the personal data; or 
• there is an absence of a right to request erasure under any law applicable to our processing of your personal data. 

Right to withdrawal of consent 

Where our processing of your personal data is based on your consent you have the right to withdraw your consent at any time. 

If you withdraw your consent, this will only take effect for future processing.