UK GDPR and your data rights

Your rights

UK data-protection law gives individuals rights over personal information. Which rights apply depends on the information, purpose and lawful basis involved.

• Be informed about how personal information is used.
• Request access to personal information and receive a copy.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for information to be erased in circumstances where the right applies.
• Ask for processing to be restricted in circumstances where the right applies.
• Receive certain information in a structured, commonly used format where data portability applies.
• Object to processing based on legitimate interests and object absolutely to direct marketing.
• Ask for human review where a significant decision is made solely by automated means and the relevant right applies.

Make a request

Email [email protected] with the subject “Data rights request”. Explain the right you want to exercise and provide enough information to locate the relevant order, message or account record.

Zellart may request proportionate evidence of identity where needed to protect personal information. Do not send identity documents until requested. Valid requests are normally answered within one calendar month; complex or multiple requests may take longer where the law permits, and Zellart will explain any extension.

Direct marketing

You can object to direct marketing at any time by using the unsubscribe control in a marketing email or contacting [email protected]. Zellart may retain a minimal suppression record so that your choice is respected in future.

Limits and complaints

Some rights are qualified rather than absolute. Zellart may need to retain information for tax, legal claims, fraud prevention, security or another lawful reason. If a request cannot be fulfilled in full, Zellart will explain the reason and available complaint route.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/. Last updated: 18 July 2026.