Data subject requests.

1. Rights you may exercise

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of data where one of the GDPR grounds applies.
• Restriction — temporary halt of processing pending verification.
• Objection — to processing based on legitimate interest.
• Portability — receipt of data in a structured, machine-readable format.
• Withdrawal of consent — where processing is based on consent.

2. How to submit a request

Write to [email protected] with the subject line beginning [DSAR] and include the items in section 3 below. Requests in any official EEA language are accepted; the firm responds in English.

3. What to include

• The right you wish to exercise.
• A description of the data concerned, sufficient to allow identification.
• The capacity in which you submit the request (data subject, authorised representative, parent of a minor).
• A means of identity verification — typically the email address used in the original communication with the firm, plus one corroborating reference (matter reference, submission timestamp, or contact-form acknowledgement number).
• Your preferred delivery channel for the response (encrypted email, postal address).

4. Verification

Where a request raises a reasonable doubt as to the identity of the requester, the firm may request further information sufficient to confirm identity before acting on the request. Identification information is processed only for verification and is retained no longer than necessary for that purpose.

5. Response time

Receipt is acknowledged within seventy-two (72) hours. A substantive response is provided within thirty (30) calendar days. Where the request is complex or where multiple requests are pending, the response window may be extended by up to two further months under Article 12(3) GDPR; in that event you are informed of the extension and the reasons for it within the initial 30-day window.

6. Cost

Requests are handled free of charge. The firm reserves the right to charge a reasonable administrative fee, or to refuse a request, where it is manifestly unfounded or excessive (Article 12(5) GDPR).

7. Refusal and appeal

Where a request is refused in whole or in part, the firm sets out the grounds in writing. You may lodge a complaint with the Dutch supervisory authority — Autoriteit Persoonsgegevens — at autoriteitpersoonsgegevens.nl, or with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

8. Records

The firm maintains an internal log of data subject requests received, the response provided, and the date of completion, for the purpose of demonstrating compliance under Article 5(2) GDPR.