Data Subject Rights

Your rights under UK GDPR and the Data Protection Act 2018, and how to exercise them including subject access requests, corrections, erasure and objections.

Approved·Version 1.0·Effective: 21 July 2026·Next review: 21 July 2027

Lycia Limited

282a Leigh Road

Leigh-on-Sea, Essex

SS9 1BW, United Kingdom

Company Registration No: 04465356

VAT Registration No: GB 155 3559 95

ICO Registration No: ZA250263

1. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  1. Right to be informed — you have the right to know how your data is used (see our Privacy Policy)
  2. Right of access — you can request a copy of the personal data we hold about you (Subject Access Request)
  3. Right to rectification — you can ask us to correct inaccurate or incomplete data
  4. Right to erasure — you can ask us to delete your data (the 'right to be forgotten'), subject to exceptions
  5. Right to restriction — you can ask us to limit how we use your data in certain circumstances
  6. Right to object — you can object to processing based on legitimate interests or for direct marketing
  7. Right to data portability — you can receive your data in a structured, machine-readable format (where applicable)
  8. Rights regarding automated decision-making — you have safeguards against solely automated decisions with legal or significant effects
  9. Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
  10. Right to complain to the ICO — if you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office

These rights are not absolute. Some rights may not apply or may be subject to exemptions, particularly where processing is necessary for legal compliance, crime prevention or the establishment, exercise or defence of legal claims.

2. How to Exercise Your Rights

You can submit a request using the form below. Alternatively, you can contact us by post at 282a Leigh Road, Leigh-on-Sea, Essex, SS9 1BW, United Kingdom.

Identity verification: Before we disclose any personal data, we need to verify your identity. We may ask for proof of identity (such as a copy of a passport or driving licence) and may contact you to confirm details. We do not disclose data until identity is appropriately verified.

Response time: We respond to requests within one month of receiving them. For complex or multiple requests, this may be extended by two further months. We will inform you of any extension and the reasons for it within the first month.

3. Submit a Request

4. Complaints

If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Phone: 0303 123 1113 | Website: ico.org.uk

You can also see our Complaints Procedure for internal escalation.

Approval Record

Approved by: Master Administrator · Approval date: 21 July 2026 · Effective date: 21 July 2026 · Next review: 21 July 2027

Legal review: Complete · Data protection review: Complete · Solicitor review: Complete