Data Subject Rights — How to Make a Request
Last updated: 12 February 2026Your Rights
Under the UK GDPR and EU GDPR, you have the right to:
- Access your personal data (Subject Access Request)
- Rectify inaccurate personal data
- Erase your personal data ("right to be forgotten")
- Restrict the processing of your personal data
- Port your data to another controller (in a structured, machine-readable format)
- Object to processing based on legitimate interests
- Withdraw consent at any time (where consent is the legal basis)
- Not be subject to solely automated decision-making with legal or similarly significant effects
How to Make a Request
By Email
Send your request to: privacy@varangian.ai
Please include:
- Your full name
- The email address or other identifier we may hold for you
- Which right you wish to exercise
- Any details that will help us locate your data (e.g., the service or context in which we may hold your data)
By Post
Data Protection
Varangian Group Ltd
71-75 Shelton Street
Covent Garden
London WC2H 9JQ
What to Expect
| Step | Timeframe |
|---|---|
| Acknowledgement | Within 5 business days of receiving your request |
| Identity verification | We may ask you to verify your identity before processing your request. This is to protect your data from unauthorised access. |
| Response | Within one calendar month of receiving your request (or identity verification, if required) |
| Extension | If your request is complex or we receive multiple requests, we may extend by a further two months. We will inform you within the first month if an extension is needed, with reasons. |
Fees
There is no fee for exercising your rights in most cases.
We may charge a reasonable fee if your request is manifestly unfounded or excessive (particularly if repetitive). In such cases, we will inform you of the fee before processing the request.
We may also refuse to act on a request that is manifestly unfounded or excessive, providing our reasons.
Special Circumstances
Threat Intelligence Data
If your data has been identified in our cyber threat intelligence operations (for example, your credentials were found in a dark web data breach):
- Right to access: We will confirm what data we hold about you and provide a copy. Where data forms part of a larger intelligence dataset, we will extract and provide only the data relating to you.
- Right to erasure: We will delete your data unless retention is necessary for the prevention or detection of crime (Data Protection Act 2018, Section 29 exemption). If we apply this exemption, we will explain our reasoning.
- Right to object: We will assess your objection on a case-by-case basis. If we determine that compelling legitimate grounds exist for continued processing, we will explain those grounds to you.
Exemptions
In limited circumstances, we may be unable to fully comply with your request. The most relevant exemptions are:
| Exemption | Legislation | When It Applies |
|---|---|---|
| Crime prevention/detection | DPA 2018, Section 29 | Where complying with your request would prejudice the prevention or detection of crime |
| Legal proceedings | DPA 2018, Schedule 2, Paragraph 5 | Where data is required for actual or prospective legal proceedings |
| Confidential references | DPA 2018, Schedule 2, Paragraph 3 | Where data consists of a confidential reference provided by us |
If we rely on an exemption, we will:
- Inform you that an exemption applies
- Explain the exemption in general terms (without disclosing information that would undermine the exemption's purpose)
- Inform you of your right to complain to the ICO
If You Are Unsatisfied
If you are not satisfied with our response, you can:
- Ask us to reconsider — contact us at privacy@varangian.ai with your concerns
- Complain to the ICO:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
- EU residents may also complain to the supervisory authority in their EU Member State of residence or place of work.
Contact
Email: privacy@varangian.ai
Post: Data Protection, Varangian Group Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ