Data Protection

GetMySAR takes data protection seriously. This page gives a plain English overview of how we handle personal data when you use getmysar.com and our Subject Access Request service.

It should be read alongside our Privacy Policy, Cookie Policy and Terms of Use.

GetMySAR helps people prepare and submit Subject Access Requests to organisations in the UK.

When you complete our online form, we use the information you provide to help create and send the request to the organisation you identify.

We also help follow up the request and remind the target organisation that a response is due within the applicable timeframe.

In the SAR process, GetMySAR acts as the go-between to help submit the request and support follow-up communications.

• the SAR is sent to the target organisation by GetMySAR;
• the organisation's response goes directly to the user or data subject; and
• GetMySAR does not receive or store the organisation's actual SAR response.

The target organisation remains responsible for the personal data it holds and for responding to the Subject Access Request.

Depending on what you submit, we may handle personal data such as:

• your name and contact details;
• details needed to identify the person making the request;
• organisation details for the target of the SAR;
• the details of the information being requested;
• signed consent forms; and
• copy identity documents where you choose to upload them.

We may also process technical and administrative information needed to operate the website and maintain records of the request process.

We use personal data to:

• provide and operate the GetMySAR service;
• prepare and submit Subject Access Requests on your behalf;
• send supporting documents where you provide them;
• communicate with you about your request;
• follow up with the target organisation;
• keep records of submissions and related communications;
• deal with complaints or disputes; and
• comply with legal and regulatory obligations.

SAR-related data is stored in the UK.

• Supabase is used in eu-west-2 (London);
• AWS S3 is used in eu-west-2 (London); and
• the website is hosted on Vercel.

This means the information you submit through the service is intended to be stored in UK-based infrastructure for our core SAR processing systems.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including:

• providing the service;
• keeping records of requests and submissions;
• handling follow-up communications;
• dealing with complaints or disputes; and
• meeting legal obligations.

When personal data is no longer needed, we may delete it or anonymise it.

We take reasonable technical and organisational measures to protect personal data.

These measures include:

• restricting access to personal data;
• using established hosting and storage providers; and
• protecting files stored in AWS S3 using server-side encryption.

No system can be guaranteed to be completely secure, but we aim to use appropriate safeguards for the type of information we process.

Depending on the circumstances, you may have rights in relation to personal data we hold about you, including rights to access, correct or request deletion of your data.

If your request relates to data held by GetMySAR, please use our contact form.

If your request relates to data held by the organisation named in your Subject Access Request, that organisation is usually responsible for responding as the data controller for its own records.

You can find more information in our Privacy Policy.

If you have questions about data protection at GetMySAR, please use our contact form.

If you are unhappy with how we handle personal data, you also have the right to complain to the Information Commissioner's Office (ICO).

ICO website: https://ico.org.uk/make-a-complaint/