Individual Rights (Data Privacy) Policy

1. Our Commitment to Transparency

1.1 UK data protection law gives individuals whose personal information is collected and/or used rights in respect of such information.

1.2 Any individual (including an employee, contractor, director, investor or financial professional) whose personal information is collected and/or used by the UK Endorsement Board (“UKEB”, “we”, “us” or “our”) will benefit from these rights in accordance with the provisions of this Individual Rights (Data Privacy) Policy (“Policy”).

2. Introduction

2.1 This Policy sets out the data protection rights of individuals in relation to information collected or held by us and sets out how we will assist individuals to exercise those rights.

2.2 Where an individual wishes to exercise their data protection rights, they can do so by making a request (Request) to us. This Policy sets out how we will deal with such Requests.

3. Data Protection Rights

3.1 The UKEB assists individuals to exercise their following data protection rights, consistent with the requirements of applicable UK data protection law, including the Data Protection Act 2018 and the GDPR. The UK GDPR provides the following rights for individuals:

3.1.1 The right to be informed: This is a right for an individual to be informed about the collection and use of their personal data. We do this through our privacy notices;

3.1.2 The right of access: This is a right for an individual to obtain confirmation of whether a controller processes personal information about them and, if so, to be provided with details of that personal information and access to it (subject access request);

3.1.3 The right to rectification: This is a right for an individual to have inaccurate personal data held by a controller rectified or, if it is incomplete, completed;

3.1.4 The right to erasure: This is a right for an individual to require a controller to erase personal information about them on certain grounds – for example, where the personal information is no longer necessary to fulfil the purposes for which it was collected;

3.1.5 The right to restrict processing: This is a right for an individual to require a controller to restrict processing of personal information about them on certain grounds;

3.1.6 The right to data portability: This is a right for an individual to receive personal information concerning them from a controller in a structured, commonly used and machine-readable format and to transmit that information to another controller, if certain grounds apply;

3.1.7 The right to object: This is a right for an individual to object to a controller's processing of personal data, in certain circumstances; and

3.1.8 Rights in relation to automated decision making and profiling: These are rights in relation to how the FRC uses an individual’s personal data in such processes.

3.2 If any Request is received in relation to a data subject’s rights (including the right to rectification, erasure, restriction, object or data portability) the Request must be referred to the Privacy Team at [email protected]. This ensures we can respond promptly to the Request.

4. Requests relating to Rights

4.1 If a Request is received for the deletion, correction or any other right relating to an individual’s personal information, the Request will be dealt with by the Privacy Team, unless it can be dealt with promptly and straightforwardly under business as usual (for example, updating address details) by the relevant team.

4.2 Requests for the deletion or correction of personal data held by the UKEB will be responded to without undue delay and within one month of receiving the Request. This may be extended by a further two months if the Request is complex or there are a number of Requests from the same individual. Where time is extended, the individual will be notified of the extension and be given an explanation as to why the extension is necessary within a month of the UKEB receiving the Request.

5. Right of Access – Subject Access Request (SAR)

5.1 An individual exercising their right to access personal information held by the UKEB, can do so by making a valid SAR. An individual is entitled to:

5.1.1 Be informed whether we hold and are processing personal information about them;

5.1.2 Be given a description of the personal information we hold, the purposes for which it is being held and processed, and the recipients or classes of recipient to whom we may disclose the personal information to; and

5.1.3 Be provided with a copy of personal information held by us in a readily understandable format, unless exemptions are applicable.

5.2 We will not usually apply a fee for SARs. Where the SAR is manifestly unfounded or excessive (e.g. it is repetitive in nature), we may either:

5.2.1 Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

5.2.2 Refuse to act on the SAR.

5.3 Prior to responding to a SAR we may require information to confirm the identity of the individual making the SAR (for example, a copy of formal identification documents) and/or to locate the information which that individual seeks.

5.4 We will respond to a SAR promptly and within one month of receipt of receiving the SAR and any information necessary to identify the individual and/or locate the requested information, or the fee, where required (whichever date is later). This may be extended by a further two months, if a SAR is complex or if we receive a number of SARs from the same individual. Where time is extended, the individual will be notified of the extension and be given an explanation as to why the extension is necessary within a month of the UKEB receiving the Request.

5.5 Personal data may be withheld if an exemption to the requirement to provide the information is applicable, set out at Schedules 2 and 3 of the DPA 2018. Where an exemption applies. We may refuse to provide all or some of the requested information, depending on the circumstances.

5.6 The UKEB has a responsibility to protect all personal information it processes and must not disclose other individuals personal information in response to a SAR if doing so is contrary to the applicable privacy law or the lawful rights and freedoms of these individuals.

5.7 We ask that SARs are directed to the Privacy Team [email protected] so that we deal with them promptly and efficiently.

6. General Queries

6.1 All queries relating to this Policy are to be addressed to the Privacy Team at [email protected]

Last reviewed: August 2026