Data Protection and Privacy Rights

What are your privacy rights and how can you exercise them?

You may access the personal data about you that we store. You may also review or make certain corrections to the personal data we store about you. You may also request the deletion of personal data about you or object to its processing. In limited circumstances, you may have data portability rights in relation to certain personal data we hold about you. These rights are not unlimited and the exercise of these rights, and the limits upon them, are briefly set out in the table below.

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we need to rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point.

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Your rights in relation to personal data

Your right 

What does it mean? 

Limitations and conditions of your right 

Right to access 

Subject to certain conditions, you are entitled to access your personal data (this is also known as a “data subject access request.”). You may also be able to access the personal information we have collected about you, the categories of sources from which the information was collected, the purposes of collecting the information, the categories of third parties we have shared the information with, and the categories of personal information that have been shared with third parties for a business purpose. 

If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations.

Under certain laws we may refuse a data subject access request depending on the circumstances of the request. For example, access may not be provided where: 

  • the burden or expense of providing access would be disproportionate to the risks to you, the requester; 
  • the rights or interests of an individual other than you would be violated, such as where access would reveal another individual’s personal data;
  • access would reveal information which we have taken steps to protect from disclosure because disclosure would help a competitor in the market (Confidential Commercial Information), such as where Confidential Commercial Information cannot be readily separated from the personal data;
  • the execution or enforcement of the law, including prevention, investigation or detection of offences or the right to a fair trial would be interfered with;
  • an investigation or grievance proceeding being conducted by us would be prejudiced; 
  • any confidentiality that may be necessary for limited periods in connection with our management of our workforce (e.g. succession planning and corporate re-organizations; or in connection with monitoring, inspections, or regulatory functions connected with sound economic or financial management);
  • a court, or other authority of appropriate jurisdiction, determines that we are not required to provide access; 
  • a legal or other professional privilege or obligation would be breached; or 
  • there is no legal requirement for us to provide such access, including because local legal requirements for a valid data subject access request have not been met.  

We may charge an administrative fee to you where the data subject access request is excessive or significantly unfounded (limited to the actual cost required to provide access to the requested personal data in the required format). 

Right to data portability 

Subject to certain conditions, you are entitled to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format. 

If you exercise this right, you should specify the type of information you would like to receive (and where we should send it) where possible to ensure that our disclosure is meeting your expectations. 

This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (i.e. not for paper records). It covers only the personal data that has been provided to us by you. 

Right in relation to inaccurate personal or incomplete data 

You may challenge the accuracy or completeness of your personal data and have it corrected or completed, as applicable. You have a responsibility to help us to keep your personal data accurate and up to date. 

We encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details, telephone number, immigration status. 

Please always check first whether there are any available self-help tools to correct the personal data we process about you. 

This right only applies to your own personal data. When exercising this right, please be as specific as possible. 

Right to object to or restrict our data processing 

Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your personal data. 

This right applies where our processing of your personal data is necessary for our legitimate interests. You can also object to our processing of your personal data for direct marketing purposes. 

Right to erasure 

Subject to certain conditions, you are entitled to have your personal data erased (also known as the “right to be forgotten”), e.g. where your personal data is no longer needed for the purposes it was collected for; where the relevant processing is unlawful, or there is an applicable law requiring erasure of the personal data; or where you have exercised a legitimate right to object to processing of your personal data. 

We may not be in a position to erase your personal data, if for example: 

  • we need it to comply with a legal obligation; 
  • we need it to exercise or defend legal claims; 
  • we need it to exercise freedom of expression and information; 
  • we need it to carry out a task in the “public interest”; 
  • we need it to archive personal data in the public interest, or for scientific, historical, or statistical research purposes if those purposes would be seriously impaired by the erasure of the personal data; or 
  • there is an absence of a right to request erasure under any law applicable to our processing of your personal data. 

Right to withdrawal of consent 

Where our processing of your personal data is based on your consent you have the right to withdraw your consent at any time. 

If you withdraw your consent, this will only take effect for future processing. 


Emailing us at

Completing the webform (California residents only)   

We will need to verify your identity before processing your request. In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems. Although we try to limit the personal information collected in connection with a request, certain requests may require us to obtain additional personal information from you. 

In certain jurisdictions, you may be permitted to use an authorized agent to exercise your rights on your behalf. If you are making any of the requests above through an authorized agent, we will request written authorization from you and will seek to verify your identity or we will accept a legal Power of Attorney to the authorized agent. Please be advised that we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. 

You also have the right to complain to a data protection authority competent for your country or region about our collection and use of your Personal Data. 

In accordance with applicable law, we will not discriminate against you for exercising these rights.