Skip to main content

How to Submit a GDPR Request

How to submit a request and what to expect when you do so.

Jacob avatar
Written by Jacob
Updated over 5 months ago

Summary

Under UK GDPR, both applicants (end users) and clients (verifiers) have the right to request deletion of or access to the personal data Konfir holds on them. Contact [email protected] with your request and we'll process it as quickly as possible.

For more detail, see our Organisation Terms and Privacy Notice.


Request types

Request type

Applicant Data

Client Data

Access (Subject Access Request)

A copy of the data Konfir holds about an applicant (e.g. details retrieved from Banking, HMRC, or Payroll for a verification).

A copy of the personal data Konfir holds about your staff or organisation (e.g. CRM records for service delivery or communication).

Deletion (Right to Erasure)

Deletion of applicant data held by Konfir in connection with a verification.

Deletion of client user/CRM data Konfir holds about your staff or organisation.

Other GDPR rights (Rectification, Restriction, Objection, Portability)

May apply depending on the data and context.

May apply depending on the data and context.


How to submit a request

  1. Email [email protected] with the subject line: GDPR Request

  2. In your message, include:

    • Type of request (Access, Deletion, etc.)

    • Whose data it relates to (Applicant or Client)

    • Details to identify the record:

      • For Applicant Data: applicant’s full name and Verification ID (if available)

      • For Client Data: full name and organisation details


What happens next?

  • Konfir will acknowledge your request promptly, confirming next steps

  • All GDPR requests are completed within 28 calendar days, as required by law.

  • For Access requests, the subject will receive a copy of the data held.

  • For Deletion requests, the subject’s data will be erased and confirmation provided.

  • All actions are logged internally for audit purposes.


Important notes

  • For applicant data, you remain the data controller; Konfir acts as a processor when handling applicant data on your behalf.

  • Konfir can only act on data stored in our platform. If you also hold copies (e.g. applicant documents), you remain responsible for managing those.

Did this answer your question?