Subject Access Request Policy


The General Data Protection Regulation (GDPR) gives you the right to find out about what information an organisation holds about you. A Subject Access Request (SAR) is a means by which an individual finds out what personal data an organisation holds about them, why it is held, and with whom it is shared. This Policy sets out how Flowe Media (Tryggr) identifies and manages its SAR responsibilities in accordance with its legal and regulatory obligations.

Making a request

A Subject Access Request (SAR) should be requested in writing, this can be done as a letter or an email. The request should be addressed to our Data Protection Officer James [surname?] and should clearly state that it is a SAR and provide any additional information that will assist in meeting your request e.g. particular types of information, date ranges etc.  

You will need to provide verification of your identity using ‘reasonable means’, and we will need to see this before we can release any data to you.  

What you can request

The data an individual has the right to obtain is as follows: ·        

Confirmation that your data is being processed;

The purposes of the processing;

The categories of personal data concerned;

The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

Your right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

Where the personal data are not collected from you, any available information as to their source;

Other supplementary information – this is mostly the same as the information held in our privacy notice.

The existence of any automated decision-making, including profiling

Your right to make a complaint to the ICO  

There is no charge for a SAR, unless the request is an unusually large or complex.  

What you will receive from us

Our DPO will provide you with a copy of any of your personal data undergoing processing. We will normally provide this in a commonly used electronic form.   SARs will normally be dealt with within one month of receipt, unless the request is an unusually large or complex. If this is the case, we will let you know that there is going to be a delay.  

We will keep a log of all SAR requests, with full details of the request and response times.   Where to send your request Please send SAR requests addressed to James Cooke, DPO, at james@loopwhole.co.uk clearly marked as SAR with your name and date of the request.