🔒

Subject Access Requests

Your right to access the personal data we hold about you, how to make a request, and what to expect from us.

Last updated March 2026 Phytoventures Ltd ICO Registered

Data Protection Officer

All Subject Access Requests and data protection queries must be sent to this address.

What Is a Subject Access Request?

Under the UK General Data Protection Regulation (UK GDPR), you have the right to request a copy of the personal data that Phytoventures Ltd holds about you. This is known as a Subject Access Request (SAR).

A SAR allows you to:

Find out whether we process your personal data
Receive a copy of that data
Understand the purposes of the processing
Know who we have shared (or will share) your data with
Know how long we intend to store your data
Be informed of your rights to rectification, erasure, restriction, or objection

🛈

Phytoventures Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. We take our obligations under UK GDPR seriously and will handle all requests lawfully and transparently.

How to Make a Request

Send your Subject Access Request by email to our Data Protection Officer:

📩

Email [email protected] with the subject line "Subject Access Request".

Your request should include:

Your full name
Your email address (and any previous email addresses you may have used with us)
Enough information for us to identify you and locate your data (e.g. which service you used — CannCare, CannConnect, CannAccess, or the main Phytoventures site)
Any specific data you're looking for, if applicable (this helps us respond faster)

SARs are free of charge. You do not need to give a reason for your request.

Identity Verification

Before we can process your request, we need to confirm your identity. This is to protect your data from being disclosed to the wrong person.

We may ask you to provide:

A copy of a government-issued photo ID (passport, driving licence)
A recent utility bill or bank statement showing your name and address

⚠️

If we cannot verify your identity, we may not be able to process your request. We will contact you to explain what's needed. The 30-day response clock pauses until verification is complete.

What Happens Next

1. We acknowledge your request

Within 3 working days of receiving your SAR, we'll send you an acknowledgement confirming we've received it and outlining the next steps.

2. We verify your identity

If we need additional verification, we'll let you know what's required. The statutory response period pauses until we can confirm your identity.

3. We locate and compile your data

Our DPO reviews all systems and records where your personal data may be stored. We compile a comprehensive response covering all data we hold.

4. We respond within 30 calendar days

Under UK GDPR, we must respond to your SAR within one calendar month (30 days) from the date we receive it — or from the date identity is verified, if verification was required.

5. You receive your data

We'll provide your data in a commonly used electronic format (typically PDF or CSV). If you'd prefer a different format, let us know and we'll do our best to accommodate.

Timeframes

The statutory deadline for responding to a SAR is one calendar month (30 days) from the date we receive your request.

In exceptional circumstances — where a request is particularly complex or we receive a large number of requests — we may extend the response period by a further two months. If this happens, we will:

Notify you within the first 30 days
Explain why the extension is necessary
Provide a revised deadline

📅

In practice, we aim to respond well within 30 days. Most straightforward SARs are completed within 14 working days.

Your Other Data Rights

In addition to Subject Access Requests, UK GDPR gives you the following rights:

Right to rectification — ask us to correct inaccurate personal data
Right to erasure — ask us to delete your personal data (the "right to be forgotten")
Right to restrict processing — ask us to limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests or direct marketing

To exercise any of these rights, email [email protected].

Not Happy With Our Response?

If you're unsatisfied with how we've handled your SAR or any data protection matter, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd always prefer to resolve any concerns directly first. Please contact our DPO at [email protected] before escalating to the ICO.

All data protection queries: [email protected]