9. Subject access requests and other rights of individuals

9.1 Subject access requests

Individuals have a right to make a ‘subject access request’ to gain access to personal information that AWH Holdings Ltd holds about them. This includes:

  • Confirmation that their personal data is being processed
  • Access to a copy of the data
  • The purposes of the data processing
  • The categories of personal data concerned
  • Who the data has been, or will be, shared with
  • How long the data will be stored for, or if this isn’t possible, the criteria used to determine this period
  • The source of the data, if not the individual
  • Whether any automated decision-making is being applied to their data, and what the significance and consequences of this might be for the individual

Subject access requests must be submitted in writing, either by letter, email or fax to the Privacy officer. They should include:

  • Name of individual
  • Correspondence address
  • Contact number and email address
  • Details of the information requested

If staff receive a subject access request they must immediately forward it to the privacy officer.

9.2 Responding to subject access requests

When responding to requests, we:

  • May ask the individual to provide 2 forms of identification
  • May contact the individual via phone to confirm the request was made
  • Will respond without delay and within 1 month of receipt of the request
  • Will provide the information free of charge
  • May tell the individual we will comply within 3 months of receipt of the request, where a request is complex or numerous. We will inform the individual of this within 1 month, and explain why the extension is necessary

We will not disclose information if it:

  • Might cause serious harm to the physical or mental health of another individual

If the request is unfounded or excessive, we may refuse to act on it, or charge a reasonable fee which takes into account administrative costs.

A request will be deemed to be unfounded or excessive if it is repetitive, or asks for further copies of the same information.

When we refuse a request, we will tell the individual why, and tell them they have the right to complain to the ICO.

9.3 Other data protection rights of the individual

In addition to the right to make a subject access request (see above), and to receive information when we are collecting their data about how we use and process it (see section 7), individuals also have the right to:

  • Withdraw their consent to processing at any time
  • Ask us to rectify, erase or restrict processing of their personal data, or object to the processing of it (in certain circumstances)
  • Prevent use of their personal data for direct marketing
  • Challenge processing which has been justified on the basis of public interest
  • Request a copy of agreements under which their personal data is transferred outside of the European Economic Area
  • Object to decisions based solely on automated decision making or profiling (decisions taken with no human involvement, that might negatively affect them)
  • Prevent processing that is likely to cause damage or distress
  • Be notified of a data breach in certain circumstances
  • Make a complaint to the ICO
  • Ask for their personal data to be transferred to a third party in a structured, commonly used and machine-readable format (in certain circumstances)

Individuals should submit any request to exercise these rights to the privacy officer. If employees receive such a request, they must immediately forward it to the privacy officer

10. Photographs and videos

As part of AWH Holdings Ltd activities, we may take photographs and record images of individuals within the company.

We will obtain written consent from employees for photographs and videos to be taken for communication, marketing and promotional materials. We will clearly explain how the photograph and/or video will be used.

Uses may include:

  • Within AWH Holdings Ltd on notice boards and in company magazines, brochures, newsletters, etc.
  • Online on our website or social media pages
  • By the company on promotional material such as brochures or website

Consent can be refused or withdrawn at any time. If consent is withdrawn, we will delete the photograph or video and not distribute it further.