Privacy Requests

This guide explains how to make a request about your personal data. It should be read with the privacy policy. It is not legal advice, and a request does not automatically require every record mentioning a person to be changed or deleted.

The UK Information Commissioner's Office (ICO) provides independent public guidance on data-protection rights.

Requests you can make

Depending on the circumstances and the law that applies, you may be able to ask us to:

• Confirm whether we process your personal data and provide access to it.
• Correct inaccurate or incomplete personal data.
• Delete personal data in circumstances where the right to erasure applies.
• Restrict particular processing while an issue is considered.
• Consider an objection to processing.
• Provide portable data where the portability right applies.
• Review a concern about consent or an automated process.

These rights are not all absolute. Legal obligations, freedom of expression and information, journalism-related provisions, security, fraud prevention, legal claims and the rights of other people may affect what we can provide or change. We will assess the request rather than assume that every right applies in the same way.

How to send a request

Email [email protected] with “Privacy request” in the subject. Tell us:

• Which right or outcome you are asking about.
• Your full name and the email address or display name connected with the service.
• The relevant account, ticket, comment, chat, advertiser account or page.
• An approximate date range.
• Any ticket or account ID that helps locate the record.
• How you would like us to contact you.

For an advertiser account, include the company name and the account email. Do not send a password, full payment-card number, Stripe receipt secret or support-ticket access key in the first message.

You do not need to use legal wording or quote a law. A clear description of the data and the outcome you want is enough to start the review.

Identity and authority

We may ask for proportionate information to confirm your identity, authority or relationship to an account before disclosing or changing personal data. This protects people from fraudulent access requests.

Do not send a passport, driving licence or other identity document unless we have explained why it is needed and agreed a suitable way to provide it. We should ask only for information reasonably needed for verification and locating the data.

If you act for someone else, explain that in the first message. We may need evidence that they authorised you. A parent or guardian request involving a child may require a case-specific assessment of identity, authority and the child's interests.

What happens during review

We identify relevant systems, check the request's scope, consider applicable rights and exemptions, and may ask a focused question if the request is unclear or broad. We may also need to protect information about another person.

Any response time is governed by the law and the circumstances of the request. This page does not promise a shorter service target. If we cannot fulfil all or part of a request, we should explain the decision where the law requires it and identify any available complaint route.

We may retain a limited record of the request and our response where necessary for security, accountability or legal claims. That does not mean every underlying record can be kept indefinitely.

Cookies and optional measurement

To revisit optional analytics and advertising choices on this browser, open cookie settings. Browser storage and cookie controls are device-specific; changing a choice on one device may not change another.

A cookie choice is separate from a request about data already held. If you want both, change the browser setting and describe the data request in your email.

Journalism and published material

A privacy request about newsroom material can engage both data protection and freedom of expression. If your concern is that a published factual claim is wrong, also use the correction form. If the material creates an immediate safety risk, use the safety report form.

Removing a public article, comment or search result is not always the same as deleting all underlying records. State the outcome you need so each part can be considered correctly.

If you are unhappy with the response

Reply to the privacy correspondence and explain what you believe remains unresolved. You can also seek independent guidance or raise a concern with the Information Commissioner's Office.

Using our internal route does not prevent you from using a legal or regulatory route, and it does not pause any deadline that applies elsewhere.