Personal-data requests

Your rights

• Access (Art. 15 GDPR): to confirm whether we process data about you and to receive a copy.
• Rectification (Art. 16): to correct inaccurate or incomplete data.
• Erasure (Art. 17): to delete your data when we no longer have grounds to keep it.
• Restriction (Art. 18): to pause processing, for example while we check whether the data is accurate.
• Objection (Art. 21): to object to processing based on legitimate interest. If you object to being contacted, we stop at once.
• Portability (Art. 20): to receive the data you gave us in a structured, machine-readable format, where we process it on the basis of consent or a contract.
• Withdrawing consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before the withdrawal.

How we verify your identity

We have to be sure we give data only to the person it is about (Art. 12(6) GDPR). So:

• we usually reply to the email address we already hold for you and ask you to confirm the request from it;
• if we have no email for you, or it doesn’t match, we will ask for additional information only you would know (for example, when and about which role we spoke);
• we do not ask for a copy of an identity document unless there is no other way, and then we will tell you which details to leave visible.

If you are making a request on someone else’s behalf, we need their written authorisation.

Timing and cost

We reply without undue delay and within one month of receipt at the latest. For complex or numerous requests, the period may be extended by two further months, and we will tell you within the first month. Replying is free. For manifestly unfounded or excessive requests, we may refuse or charge a reasonable fee (Art. 12(5) GDPR).

What happens after erasure

We delete your data from all our systems and notify the recipients we shared it with, unless that is impossible or involves disproportionate effort (Art. 19 GDPR). If you also ask us not to contact you again, we keep only a one-way coded form (a hash) of your contact details on a do-not-contact list, to honour your request.

Right to complain

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, www.cpdp.bg, kzld@cpdp.bg. We would appreciate the chance to resolve the matter first, so please feel free to contact us at privacy@huntconsult.space.