A detailed explanation of each right is provided below to ensure full transparency.

2.1. Right to Be Informed (Articles 13 & 14): Clients have the right to be informed about the collection and use of your personal data. This is a key transparency requirement under the UK GDPR. GoGorilla fulfils this obligation by providing detailed privacy information, including our purposes for processing your personal data, retention periods, and who it will be shared with, at the time your data is collected. This information is readily accessible via our Privacy Policy.

2.2. Right of Access (Article 15): This right enables clients to request confirmation of whether their personal data is being processed and to receive copies of that data, alongside supplementary information regarding its use.

2.3. Right to Rectification (Article 16): Clients have the right to request the correction of any inaccurate or incomplete personal data held by the Company.

2.4. Right to Erasure (Article 17): Also known as the ‘right to be forgotten’, this allows clients to request the deletion of their personal data where it is no longer necessary for its original purpose, where consent is withdrawn, or where there is no overriding legitimate interest to continue processing.

2.5. Right to Restrict Processing (Article 18): This right permits clients to request a limitation on the processing of their data, for example, whilst the accuracy of the data is being contested or if the processing is unlawful.

2.6. Right to Data Portability (Article 20): Clients may request their personal data in a structured, commonly used, and machine-readable format (such as CSV or JSON) for transfer to another service provider, where processing is based on consent or contract and is automated.

2.7. Right to Object (Article 21): Clients have the right to object to the processing of their personal data based on legitimate interests or for direct marketing purposes. All direct marketing will cease immediately upon objection. For general objections, processing will cease unless compelling legitimate grounds override the interests of the data subject.

2.8. Rights Related to Automated Decision-Making (Article 22):  This provides the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. You may request human intervention in the decision-making process, express your point of view, and contest the decision.

3. PROCEDURE FOR EXERCISING RIGHTS

A formal and secure process is in place for handling all data rights requests.

• Submission of Request: All requests should be submitted in writing to privacy@gogorilla.com with the subject line “Data Rights Request” to ensure efficient processing.

• Identity Verification: To protect client data, identity verification will be required before processing a request. This may involve confirming account details or providing a copy of an identification document.

• Response: A response will be provided within one month of receipt. This may be extended to three months for complex requests, in which case the client will be informed of the extension.

• Cost: All data rights requests are processed free of charge. A reasonable fee may be applied only for requests that are manifestly unfounded or excessive.