DATA SUBJECT ACCESS REQUEST POLICY

Purpose of the policy

The purpose of this document is to outline Convosight’s policy in relation to the management of data subject access requests. A subject access request enables a data subject to gain access to any personal information held about them by Convosight. It promotes the right of data subjects to submit a subject access request in order to obtain a copy of such information held about them by Convosight, as the data controller/ data processor / both. It also outlines the procedure to be followed by data subjects when submitting a data access request to Convosight.

• Ownership

  The Data Subject Access Request Policy is maintained by Convosight’s Data Protection Officer (DPO), who is responsible for dealing with all subject access requests received by the Convosight. All questions or comments related to this policy or a specific subject access request should be directed to the DPO.

• What is personal information?

  Personal information is any data, in both physical and electronic form, related to an identified or identifiable person. It includes anything that can be used to identify a person, directly or indirectly, by means of his or her physical, physiological, mental, economic, cultural or social identity.

• What is a data subject access request?

  A data subject access request is a written request for personal information held about a data subject by Convosight. Under Article 15 of the GDPR the data subject has the right to see if Convosight is processing their personal data and receive a copy of the data itself. In particular, data subject have the right to the following information:

  1. The data itself in a permanent and intelligible format;

  2. The purposes of the processing;

  3. The categories of personal data concerned;

  4. The recipients or categories of recipient to whom the personal data have been or will be disclosed;

  5. Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

  6. The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

  7. The right to lodge a complaint with a supervisory authority;

  8. Where the personal data is not collected from the data subject, any available information as to their source;

  9. The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

• How do you make a subject access request?

  To allow us to respond promptly to any data subject access request we ask you to:

  1. Download the Access Request Form, available here.

  2. Please ensure that the form is completed, signed, and dated. Provide specific details about the information you wish to access.

  3. Attach the completed request form, along with proof of identity and address, to reachus@convosight.com electronically.

  Use of the Data Subject Access Request Form is not mandatory. However, completing the form should enable us to process your request more efficiently.

• What do we do when we receive a valid data subject access request?

  Convosight will first check whether we have enough information to be sure of your identity. However, in rare cases we may request additional evidence need to confirm your identity. Convosight does this to ensure that we only disclose information about personal data to the data subject.

  Convosight will then check that we have enough information to find the records you requested. If we further require any information, then we will promptly reach out to data subject.

  Convosight will then conduct a full search of all our relevant databases and collect all data relevant to the subject access request. Provided that none of the restrictions specified in Article 23 of the GDPR apply, we will then share with you the data and the additional information which you are entitled to.

  The copy of the requested material will be supplied electronically, as the data subject on receipt of the material.

• Are there any fees payable?

  While in most instances, there is no charge, we reserve the right, in accordance with Article 12 of the GDPR, to charge a fee or refuse the request if it is considered to be "manifestly unfounded or excessive." Subsequent copies may incur a reasonable fee based on administrative costs.

• How soon will subject access request be dealt with?

  All valid data subject access requests, accompanied by valid proof of identity, received by Convosight will be dealt with within 30 days of the latest of the following:

  1. Our receipt of your request; or

  2. Our receipt of any further information we may ask you to provide to enable us to comply with your request.