This document explains the rights you have over the personal data we hold about you, how to make a request, what we will do, how long it will take, and the limited circumstances in which we cannot do everything you ask. It sits alongside the Privacy Policy, which explains what we collect and why.
1. WHO IS RESPONSIBLE FOR YOUR DATA
Sandbox Corp Limited is the controller of the personal data described in the Privacy Policy. We are registered in England and Wales under company number 17485326 and our registered office is at 21 Ellis Street, London, England, SW1X 9AL, United Kingdom. We trade as Pet Care Essentials and as PCE.
We are registered with the Information Commissioner's Office under registration number [ZA000000].
You can reach our data protection contact at [privacy@pce.org.uk], or by post at the registered office marked for the attention of the Data Protection Lead.
2. YOUR RIGHTS IN FULL
| Right | What it means in practice |
|---|---|
| To be informed | To be told what we collect, why, on what legal basis, who we share it with and how long we keep it. The Privacy Policy is how we do this. |
| Of access | To be given a copy of the personal data we hold about you, together with information about how it is used. This is commonly called a subject access request. |
| To rectification | To have inaccurate data corrected and incomplete data completed. For keeper details you can do most of this yourself in your account, and doing so is also your statutory duty. |
| To erasure | To have data deleted where one of the grounds in Article 17 of the UK GDPR applies. This right is not absolute and section 7 explains where it is limited. |
| To restrict processing | To have us stop using data, while still storing it, for example while we check whether it is accurate or while an objection is considered. |
| To data portability | To receive the data you gave us in a structured, commonly used, machine readable format, and to have it sent to another controller where that is technically feasible. This applies to data you provided, processed by automated means, on the basis of consent or contract. |
| To object | To object to processing based on our legitimate interests. You have an absolute right to object to direct marketing and we will stop immediately. |
| Relating to automated decisions | Not to be subject to a decision based solely on automated processing that produces a legal effect or similarly significantly affects you. We do not make decisions of that kind. |
| To withdraw consent | Where we rely on your consent, to withdraw it at any time. Withdrawal does not affect anything done before you withdrew. |
3. HOW TO MAKE A REQUEST
You can make a request in any of these ways:
- (a) by email to [privacy@pce.org.uk];
- (b) through the contact form at pce.org.uk;
- (c) by telephone on 0800 000 0000; or
- (d) by post to the Data Protection Lead, Sandbox Corp Limited, 21 Ellis Street, London, England, SW1X 9AL, United Kingdom.
You do not have to use a particular form of words, you do not have to quote any legislation, and you do not have to use a form. A request made verbally is as valid as one made in writing. If you make a request verbally we will confirm it back to you in writing so that we both have a record of what you asked for.
You do not have to give a reason for a request for access, rectification or portability.
If you need help making a request, or need us to respond in a particular format, tell us and we will make reasonable adjustments.
4. WHAT HELPS US ANSWER QUICKLY
A request is valid without any of the following, but giving us what you can will usually mean a faster and more useful answer:
- (a) the name and address recorded on the account;
- (b) the microchip number of any animal concerned;
- (c) your membership or account number;
- (d) the date range you are interested in, if it is not everything;
- (e) the type of information you want, for example call recordings, enquiry logs, or location history; and
- (f) how you would like to receive the response.
If a request is very broad we may ask you to narrow it. You do not have to, and if you decline we will still answer it. Asking does not stop the clock unless the request is one we genuinely cannot act on without more information.
5. PROVING WHO YOU ARE
We will ask you to confirm your identity before we release personal data. This protects you. Keeper details are exactly the kind of information someone might try to obtain by pretending to be you.
Where you are contacting us from the email address or telephone number already recorded on the account, and you can confirm details that only the account holder would know, that will usually be enough.
Where it is not, we may ask for one document confirming your identity and one confirming your address. We will ask for the minimum necessary and we will delete the copies once we have completed the check.
The time limit in section 6 does not begin until we have verified your identity.
6. HOW LONG WE TAKE AND WHAT IT COSTS
We will respond within one month of receiving your request, or of verifying your identity if that is later.
We may extend the period by up to two further months where a request is complex or where you have made a number of requests. If we do, we will tell you within the first month and explain why.
There is no fee. We may charge a reasonable fee based on administrative cost, or refuse to act, only where a request is manifestly unfounded or excessive, for example where it repeats a request we have already answered. If we take either step we will explain why and tell you how to challenge it.
Where we hold a large volume of data about you we may ask you to specify what you want before we respond. This is permitted where we process a large quantity of information about you, and it does not reduce your entitlement.
7. WHERE WE CANNOT DO EVERYTHING YOU ASK
These are the situations that arise most often with a pet register. We will always tell you which one we are relying on and why.
Deleting a microchip registration
We cannot simply delete a registration on request. The record exists so that the animal can be identified and returned, and we hold it in order to meet the conditions imposed on database operators by the microchipping regulations. Article 17(3)(b) of the UK GDPR provides that the right to erasure does not apply where processing is necessary for compliance with a legal obligation. Where you ask us to erase a registration we will consider the request, tell you what we can do, and explain what we cannot delete and why. We will always correct anything inaccurate.
Records of a previous keepership
When an animal passes to a new keeper we record the change. We keep a record that the transfer happened, and the date, so that the chain of keepership can be evidenced if it is ever questioned. If you are a previous keeper and you ask us to erase your details, we will remove you as the current keeper and remove your contact details from active use, but we may retain a minimal record of the transfer for the period stated in the Privacy Policy.
Enquiry and audit logs
We log every search of the register, who made it and when. These logs are how misuse is detected and investigated, and how we evidence a disclosure if it is challenged. We retain them for the period stated in the Privacy Policy and we will not delete them on request, because doing so would defeat the purpose for which they exist and would weaken the protection they give to every keeper.
Information about other people
A response to a subject access request gives you your own personal data. Where a record also contains information about someone else, for example a message exchanged with another member or a note of a call from a person who found your animal, we will either obtain that person's agreement or redact their information, unless it is reasonable to disclose without their agreement. We will tell you where we have redacted and why.
Other exemptions
The Data Protection Act 2018 provides exemptions that may apply in particular cases, including for the prevention and detection of crime, for the assessment or collection of tax, for legal professional privilege, and for information relating to negotiations with you. We apply an exemption only where it genuinely applies, only to the part of the response affected, and we tell you that we have done so.
Objecting where we are not relying on legitimate interests
The right to object under Article 21 applies to processing based on legitimate interests or on a public task. Much of what we do with keeper details is based on the contract with you and on our legal obligations as a database operator, so the right to object does not apply to it. Your right to object to direct marketing is separate, is absolute, and always applies.
8. REQUESTS MADE BY SOMEONE ELSE
You may ask another person to make a request for you, including a relative, a friend or a solicitor.
We will need evidence that they are authorised to act for you. A signed letter of authority from you is usually enough. For a solicitor, written confirmation that they act for you is enough.
Where someone holds a lasting power of attorney, a deputyship order or other legal authority, we will need to see it.
If we are not satisfied that a person is authorised, we will respond to you directly rather than to them.
9. REQUESTS ABOUT A PERSON WHO HAS DIED
Data protection law protects living individuals. The rights in this document do not apply to the personal data of a person who has died.
We recognise that this situation arises, because a registered keeper may die while their animal is still living. Where an executor, administrator or family member contacts us we will deal with the practical question, which is usually the transfer of the animal to a new keeper. We will ask for evidence of the death and of the person's entitlement to deal with the estate or with the animal, and we will record the transfer without charge.
We will not disclose the deceased person's wider account history unless we are satisfied that there is a proper basis for doing so.
10. PROFESSIONALS AND TRADE ACCOUNT HOLDERS
If you are a veterinary surgeon, veterinary nurse, local authority officer, implanter, breeder or trade account holder, the rights in this document apply to your own personal data in the same way.
A request from you for your own data does not entitle you to keeper records, to enquiry logs relating to other users, or to another professional's information.
Where you have made enquiries of the register, the log of those enquiries is your personal data as well as ours. You may ask for a copy of it. We will not delete it on request, for the reason given in section 7.
11. DATA BREACHES
If a personal data breach is likely to result in a high risk to your rights and freedoms we will tell you without undue delay, describe what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.
Where a breach is reportable we notify the Information Commissioner's Office within 72 hours of becoming aware of it.
If you believe your data has been compromised, tell us at once using the contact details in section 1.
12. IF YOU ARE NOT SATISFIED
Tell us first. Contact our data protection contact and explain what you are unhappy with. We will look at it again.
You may also use the Complaints Procedure.
You have the right to complain to the Information Commissioner's Office at any time, and you do not have to come to us first. The Information Commissioner's Office can be reached at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
You also have the right to seek a remedy through the courts, and to claim compensation where you have suffered damage as a result of a breach of data protection law.