You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email [email protected] with “Data request” in the subject line. We respond within 30 days, and using these rights never costs you anything or changes your service.
1. Rights available to you
| Right | What it means |
|---|---|
| Know / access | Ask what personal information we hold about you, where it came from, why we hold it and who we share it with. |
| Portability | Receive a copy in a portable, machine-readable format. |
| Correction | Have inaccurate or incomplete information corrected. |
| Deletion | Ask us to delete your information, subject to records we are legally required to keep. |
| Opt out of sale or sharing | We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. |
| Limit use of sensitive information | We do not collect sensitive personal information for the purposes that would trigger this right. |
| Withdraw consent | Withdraw consent at any time where we rely on it, without affecting processing already carried out. |
| Object / restrict | Object to, or ask us to restrict, processing based on legitimate interests. |
| Non-discrimination | Exercising any right never affects the price you paid or the service you receive. |
2. Which laws apply to you
California residents have these rights under the CCPA as amended by the CPRA. Residents of other US states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah and Texas — have broadly equivalent rights. Residents of the EEA and the UK have equivalent rights under the GDPR and UK GDPR. We extend the same process to everyone, wherever you live.
3. How to make a request
Email [email protected] with “Data request” in the subject line. Tell us which right you want to exercise and include the email address associated with your account. That is all that is required.
4. How we verify you
We verify a request by confirming control of the email address on the account, and by matching details you provide against what we already hold. For a deletion request we may ask for one additional matching detail, because deletion cannot be undone. We will not ask you for a government identification number, and we use anything you send only to verify the request.
5. Authorised agents
You may use an authorised agent to make a request on your behalf. We will ask for written permission signed by you, and we may still contact you directly to confirm.
6. Timing
We acknowledge requests promptly and respond substantively within 30 days. Where a request is complex or you have made several, we may extend by a further 30 days and will tell you if so, along with the reason.
7. When we may decline
We may decline in part where the law requires us to retain the information — for example order and transaction records kept for seven years to satisfy tax and accounting rules — or where a request is manifestly unfounded or excessive. If we decline any part of a request, we will tell you which part and why.
8. Complaints
If you are unhappy with how we handled a request, reply to our response and ask for it to be reviewed. You also have the right to complain to your data protection authority: the Information Commissioner's Office in the UK, your national supervisory authority in the EEA, or the California Privacy Protection Agency or your state Attorney General in the United States.
9. Related pages
See the Privacy Policy for what we collect, why, how long we keep it and who we share it with.