Your Data Rights

This page sits alongside the Privacy Notice. The Privacy Notice tells you what we collect and why. This page tells you what you can make us do about it, and how.

Rights under GDPR and UK GDPR

• Access. Ask for a copy of the personal data we hold about you.
• Rectification. Have inaccurate data corrected and incomplete data completed.
• Erasure. Have data deleted where we no longer have a lawful basis to keep it.
• Restriction. Have processing paused while a dispute about accuracy or basis is resolved.
• Portability. Receive data you gave us in a structured, machine readable form.
• Objection. Object to processing carried out on the basis of legitimate interests.
• Withdraw consent. Where processing rests on consent, withdraw it at any time, without affecting what was lawful before you did.
• Complain. Lodge a complaint with your supervisory authority. We would rather you told us first, but you do not have to.

If you are in the UK or the European Economic Area

We are established in the United States and have not yet appointed a representative in the European Economic Area or the United Kingdom under Article 27. We would rather tell you that than leave you to discover it. It does not narrow your rights: every right listed above is honoured from here on the same timescales, the desk address is monitored by a person, and you can complain to your own supervisory authority at any time without going through us first. Appointing representatives is in hand and this page changes the day it is done.

Rights under US state privacy laws

• Know and access the categories and specific pieces of personal information collected about you.
• Delete personal information, subject to the exceptions those laws set out.
• Correct inaccurate personal information.
• Opt out of sale, sharing for cross context behavioural advertising, and profiling with legal or similarly significant effects.
• Non discrimination. Exercising a right will never cost you service or price.

We do not sell personal information and we do not share it for cross context behavioural advertising, so there is no opt out to operate. We honour Global Privacy Control signals by default in any event.

How to make a request

• Send the request to the desk by email at sales@goldlabelmedia.net, marked "Data request", and say which right you are exercising.
• Include your case reference if you have one. It is the fastest way for us to find the right record.
• We will verify that the request is really yours before we act on it, proportionately to what is being asked for. We will not demand identity documents for a simple deletion request.
• We respond within one month for GDPR and UK GDPR requests and within forty five days for US state law requests, and we will tell you if we need an extension that the law allows.
• An authorised agent may act for you where the applicable law allows it, with written authority.

What we keep even after a deletion request

Where we are legally required to retain something, or need it to establish, exercise or defend a legal claim, we keep the minimum necessary and nothing else, and we tell you what that is. Everything else goes.