Lawful bases and data protection rights Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website: • Yourrightofaccess-Youhavetherighttoaskusforcopiesofyourpersonal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access. • Yourrighttorectification-Youhavetherighttoaskustocorrectordeletepersonal information you think is inaccurate or incomplete. Read more about the right to rectification. • Yourrighttoerasure-Youhavetherighttoaskustodeleteyourpersonal information. Read more about the right to erasure. • Yourrighttorestrictionofprocessing-Youhavetherighttoaskustolimithowwe can use your personal information. Read more about the right to restriction of processing. • Yourrighttoobjecttoprocessing-Youhavetherighttoobjecttotheprocessingof your personal data. Read more about the right to object to processing. • Yourrighttodataportability-Youhavetherighttoaskthatwetransferthe personal information you gave us to another organisation, or to you. Read more about the right to data portability. • Yourrighttowithdrawconsent–Whenweuseconsentasourlawfulbasisyouhave the right to withdraw your consent at any time. Read more about the right to withdraw consent. If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.