Your GDPR Rights
The General Data Protection Regulation gives you powerful rights over your personal data. Here's what they mean and how to exercise them.
Right of Access (Article 15)
You have the right to request a copy of all personal data we hold about you. This is known as a Subject Access Request (SAR).
We will provide your data in a commonly used electronic format, free of charge. We may request proof of identity before processing your request.
Right to Rectification (Article 16)
You can request correction of any inaccurate or incomplete personal data we hold. If you have an account, you can also update much of your information directly through your profile settings.
Right to Erasure (Article 17)
Also known as the "right to be forgotten". You can request deletion of your personal data when:
- The data is no longer necessary for the purpose it was collected
- You withdraw consent and there is no other legal basis
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
Note: We may need to retain certain data to comply with legal obligations (e.g., tax records for 6 years under Spanish law).
Right to Restrict Processing (Article 18)
You can ask us to restrict (pause) processing of your data in certain circumstances, such as while we verify the accuracy of contested data, or if you need the data for legal claims.
Right to Data Portability (Article 20)
You can request your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV). This applies to data you have provided and that we process based on consent or contract.
You can also request that we transmit your data directly to another controller where technically feasible.
Right to Object (Article 21)
You have the right to object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
You can object to direct marketing at any time, and we will comply immediately.
Right to Withdraw Consent (Article 7)
Where we process your data based on your consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
For cookie consent, you can update your preferences via the cookie banner on our website.
How to Exercise Your Rights
To exercise any of these rights, send an email to:
Please include:
- Your full name and email address associated with your account
- A clear description of the right you wish to exercise
- Any relevant details to help us locate your data
Response Timeline
We will acknowledge your request within 72 hours and provide a full response within 30 days. In complex cases, we may extend this by an additional 60 days with notice.
Identity Verification
For security, we may need to verify your identity before processing certain requests. This helps protect your data from unauthorised access.