What is a Subject Access Request (SAR)?
A Subject Access Request (SAR) is a request made by an individual to obtain a copy of the personal data we hold about them, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
A SAR allows you to understand what personal information we hold about you, why we hold it, and how we use it.
How do I submit a Subject Access Request?
You can submit your request by contacting our Customer Support team using the details below:
Email: [email protected]
Telephone: 0333 358 3377
Please let us know that you are making a Subject Access Request so we can process it as quickly as possible. We aim to acknowledge your request within 2 working days. If we need to verify your identity, we'll contact you to explain what information we need before we can begin processing your request.
What information do I need to provide?
To help us verify your identity and locate your account, we'll normally ask you to provide:
Your full name
Your full address, including postcode
The email address registered on your account (if different from the one you're contacting us from)
Your Bunch account number (if known)
A photograph of a valid passport or driving licence showing your name and photograph
If we need any additional information to verify your identity, we'll let you know.
Why do I need to provide proof of identity?
We take the security of your personal information seriously. Before releasing any personal data, we must be satisfied that we are providing it to the correct person. Verifying your identity helps protect your information from unauthorised access and forms part of our obligations under UK GDPR and the guidance issued by the Information Commissioner's Office (ICO).
Any identification documents you provide will only be used to verify your identity for your Subject Access Request and will be handled securely in accordance with our Privacy Policy.
What forms of ID do you accept?
We'll normally ask for one form of valid photographic identification, such as:
Passport
UK Driving Licence
Government-issued national identity card (where applicable)
If we require any additional information to verify your identity, we'll explain this when we contact you.
When does the 30-day timeframe begin?
Under UK GDPR, we normally have one calendar month to respond to a valid Subject Access Request.
If we need additional information to verify your identity, the one-month timeframe will begin once we have received sufficient information to confirm your identity.
We will review any identification you provide as soon as reasonably practicable before continuing with your request.
If your request is particularly complex or involves a large amount of information, UK GDPR allows us to extend the response period by up to a further two months. If this applies, we'll let you know within the initial one-month period and explain why an extension is required.
What information will I receive?
As part of your Subject Access Request, you may receive copies of the personal data we hold about you, including:
Your customer account information
Notes recorded on your account
Copies of emails you've sent to us or we've sent to you
Call recordings or call transcripts (where available)
Copies of contracts and agreements relating to your services
Billing and payment information containing your personal data
Any other personal data we're required to disclose under UK data protection legislation
Please note that some information may be withheld or redacted where we are legally required to protect another person's personal data, maintain confidentiality, or where another exemption under UK GDPR or the Data Protection Act 2018 applies.
A Subject Access Request gives you access to your personal data. It does not necessarily include internal business documents, legal advice, or information relating to other individuals where exemptions apply.
Is there a charge for making a Subject Access Request?
No. Subject Access Requests are generally provided free of charge.
However, in limited circumstances, where a request is considered manifestly unfounded or excessive, we may refuse to comply with the request or charge a reasonable administrative fee, as permitted under UK GDPR.
Can someone make a request on my behalf?
Yes. If someone is acting on your behalf, we'll need:
Written authorisation confirming they have permission to act on your behalf.
Proof of your identity.
Proof of identity for your authorised representative.
We cannot release any personal information until these requirements have been met.
What if I don't provide proof of identity?
If we're unable to verify your identity, we won't be able to process your Subject Access Request. This helps ensure your personal information remains secure and is only disclosed to the correct individual, in line with our obligations under UK GDPR and ICO guidance.
What if I believe my personal information is incorrect?
If you believe any of the personal information we hold about you is inaccurate or incomplete, please let us know.
You have the right to request that inaccurate personal data is corrected. We'll review your request and make any necessary updates where appropriate.
Where can I find out more?
You can find more information about how we collect, use and protect your personal data in our Privacy Policy.
You can also find independent guidance on Subject Access Requests by visiting the Information Commissioner's Office (ICO) website at https://ico.org.uk.
What if I have questions about my Subject Access Request?
If you have any questions about submitting a Subject Access Request or our identity verification process, please contact our Customer Support team:
Email: [email protected]
Telephone: 0333 358 3377