The plain-English overview
This page helps you use your data protection rights. It complements our Privacy Policy, which explains the information we collect and our reasons for using it.
Please note: This page provides the applicable website wording; it is not personal legal advice. Statutory rights always take priority.
Your rights
- Be informed: receive clear information about processing.
- Access: ask whether we process your information and obtain a copy.
- Rectification: correct inaccurate or incomplete information.
- Erasure: ask for deletion where the legal conditions apply.
- Restriction: ask us to limit use in specified circumstances.
- Portability: receive certain information you provided in a structured, commonly used, machine-readable format.
- Object: object to legitimate-interest processing in relevant circumstances and to direct marketing at any time.
- Automated decisions: obtain safeguards relating to certain solely automated decisions with legal or similarly significant effects.
Rights depend on the lawful basis and are not all absolute. We will explain any lawful limitation.
How to make a request
- Use the Contact page and state “Data rights request”.
- Tell us the right you wish to exercise and give enough detail to locate the relevant information.
- Do not send identity documents unless requested through an appropriate route.
- We will acknowledge, verify where proportionate and respond without undue delay—normally within one month.
Complex or numerous requests may lawfully take longer; we will explain any extension. Requests are normally free, but the law permits a reasonable fee or refusal for requests that are manifestly unfounded or excessive.
Identity, authorised representatives and security
We may ask focused questions or proportionate evidence to protect information from disclosure to the wrong person. An authorised representative should provide evidence of authority. Verification information is used for the request and retained only as reasonably necessary for accountability and security.Objection to direct marketing
You have an absolute right to object to processing for direct marketing. Use the unsubscribe control in an email or contact us. We may retain a minimal suppression record so we remember not to send further marketing.Concerns and complaints
Please contact us first so we can investigate and put matters right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority. The ICO’s website is ico.org.uk/make-a-complaint.
Raising a concern does not affect other legal remedies available to you.
Security incidents
We assess suspected personal-data breaches, contain them, record decisions and notify affected people or the ICO when the legal risk threshold is met. Where an ICO notification is required, the target is without undue delay and, where feasible, within 72 hours of awareness.QUICK ANSWERS
Your Data Rights (UK GDPR) FAQs
How long does a data request take?
We normally respond within one month after receiving a valid request and completing necessary verification.
Will I always receive everything?
Some information may be exempt or contain another person’s rights. We will explain any material withholding where the law permits.
Can someone act for me?
Yes, but we may require evidence that they are authorised and may still verify identity.
Can I complain to the ICO?
Yes. You can complain to the ICO, although contacting BROel first may allow us to resolve the issue quickly.
NEED CLARITY?
Talk to BROel.
Ask a policy question, exercise a data right or request an accessible copy.