Use one route for privacy and marketing requests.

Describe the right you want to exercise.

The person concerned or an authorized representative may submit.

Provide enough information to locate the relevant relationship without including unnecessary sensitive information. A representative may be asked to show authority.

Verification must be proportionate to the request.

Allocyn may confirm the account, business relationship, email control, or another relevant identifier before disclosing, correcting, exporting, or deleting information. Verification information is used for the request and security record.

Workspace requests may need the customer organization.

When a customer controls the purpose and use of workspace data, Allocyn normally directs the request to that organization or assists it under the Data Processing Agreement. Allocyn handles requests concerning information it controls directly.

Formal rights requests are handled without undue delay.

For requests under GDPR Articles 15 to 22, the response deadline is normally no later than one month from receipt. Where the GDPR permits an extension because of complexity or the number of requests, it may be extended by up to two further months; the person must be told and given the reason within the first month. A lawful refusal must be communicated without delay and no later than one month, with reasons and information about both a supervisory-authority complaint and judicial remedy.

Raise the concern with Allocyn or a supervisory authority.

A person can use the privacy route to escalate a concern and may complain to the relevant data-protection supervisory authority. A direct-marketing objection takes effect immediately for the supplied address and is maintained in a durable suppression record. The related case remains open for any formal response, identity check, or representative-authority review that is still required.