Purpose of the policy
The purpose of this document is to outline AVIZVA’s policy in relation to the management of data subject access requests. A subject access request enables a data subject to gain access to any personal information held about them by AVIZVA. It promotes the right of data subjects to submit a subject access request in order to obtain a copy of such information held about them by AVIZVA, as the data controller/ data processor / both. It also outlines the procedure to be followed by data subjects when submitting a data access request to AVIZVA.
Ownership
The Data Subject Access Request Policy is maintained by AVIZVA’s Legal Department, who is responsible for dealing with all subject access requests received by AVIZVA. All questions or comments related to this policy or a specific subject access request should be directed to Legal@AVIZVA.com and CC ithelpdesk@AVIZVA.com.
What is personal information?
Personal information is any data, in both physical and electronic form, related to an identified or identifiable person. It includes anything that can be used to identify a person, directly or indirectly, by means of his or her physical, physiological, mental, economic, cultural or social identity.
What is a data subject access request?
A data subject access request is a written request for personal information held about a data subject by AVIZVA. Under AVIZVA’s Privacy Policy, the data subject has the right to see if AVIZVA is processing their personal data and has received a copy of it. In particular, data subject have the right to the following information:
- The data itself in a permanent and intelligible format;
- The purposes of the processing;
- The categories of personal data concerned;
- The recipients or categories of recipient to whom the personal data have been or will be disclosed;
- Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- The right to lodge a complaint with a supervisory authority;
- Where the personal data is not collected from the data subject, any available information as to their source;
- The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
How do you make a subject access request?
To allow us to respond promptly to any data subject access request we ask you to:
- Download the Access Request Form, available here.
- Please ensure that the form is completed, signed, and dated. Provide specific details about the information you wish to access.
Attach the completed request form, along with proof of identity and address, to Legal@AVIZVA.com and CC ithelpdesk@AVIZVA.com .
What do we do when we receive a valid data subject access request?
AVIZVA will first check whether we have enough information to be sure of your identity. However, in rare cases we may request additional evidence need to confirm your identity. AVIZVA does this to ensure that we only disclose information about personal data to the data subject.
AVIZVA will then check that we have enough information to find the records you requested. If we further require any information, then we will promptly reach out to data subject.
AVIZVA will then conduct a full search of all our relevant databases and collect all data relevant to the subject access request. Provided that none of the restrictions specified in Article 23 of the GDPR apply, we will then share with you the data and the additional information which you are entitled to.
The copy of the requested material will be supplied electronically, as the data subject on receipt of the material.
Are there any fees payable?
While in most instances, there is no charge, we reserve the right, in accordance with Article 12 of the GDPR, to charge a fee or refuse the request if it is considered to be “manifestly unfounded or excessive.” Subsequent copies may incur a reasonable fee based on administrative costs.
How soon will the subject access request be dealt with?
All valid data subject access requests, accompanied by valid proof of identity, received by AVIZVA will be dealt with within 30 days of the latest of the following:
Our receipt of any further information we may ask you to provide to enable us to comply with your request.