Summary
Under UK GDPR, you have legal rights over your personal data. Here's what those rights are and who to contact - because in a Konfir verification, two organisations may be involved.
Your rights under UK GDPR
Right to erasure ("right to be forgotten")
Request deletion of your data where there is no ongoing legal basis for retaining it.
Right of access (DSAR)
Request a copy of the personal data held about you.
Right to rectification
Request correction of inaccurate or incomplete data.
Right to restrict processing
Ask for processing to be paused while a dispute is resolved.
Right to object
Object to processing carried out on the basis of legitimate interests.
Right to portability
Receive your data in a structured, machine-readable format.
Who handles your request
Two organisations are involved in your verification:
Your verifier is the Data Controller
Your verifier decides why your data is processed and how long it's kept. Requests about why your data was processed, what your verifier holds, or how long they retain it should go to your verifier directly.
Konfir is the Data Processor
Konfir processes your data on behalf of your verifier. Requests about data that Konfir processed can be submitted to [email protected], and Konfir will coordinate with your verifier where needed.
ℹ️ Future use consent exception: If you consented at the end of your verification journey to Konfir storing your data for future use, Konfir acts as a joint Data Controller alongside your verifier for that stored data. You can withdraw this consent at any time by emailing [email protected].
Response timelines
GDPR requests are normally completed within one calendar month. If your request requires coordination between Konfir and your verifier, it may take slightly longer - Konfir will keep you informed of progress.
Right to complain
If you're unhappy with how Konfir has handled your personal data, you can raise a complaint with the UK's Information Commissioner's Office (ICO).