Your Data Rights
Last updated 22 September 2026
This page explains the rights you have over your personal data under the UK GDPR and the EU GDPR, how to use them with SpendPilot, and how to complain if you are unhappy. It is part of our Privacy Policy.
1. Your rights
| Right | What it means | Quickest way to use it |
|---|---|---|
| Access | Find out what personal data we hold about you and receive a copy | Settings > Privacy > Download my data |
| Rectification | Correct data that is wrong or incomplete | Edit it in the app, or email us |
| Erasure | Have your data deleted | Settings > Account > Delete account |
| Restriction | Ask us to pause processing while a dispute is resolved | Email us |
| Portability | Receive the data you gave us in a machine-readable format (JSON or CSV), and have it sent to another provider where feasible | Settings > Privacy > Download my data |
| Objection | Object to processing based on legitimate interests, and to direct marketing at any time | Settings > Notifications, or the unsubscribe link in any email, or email us |
| Withdraw consent | Stop processing that relies on your consent, including dietary data, analytics and marketing | Settings > Privacy |
| Automated decisions | Not be subject to a decision with legal or similarly significant effects made solely by automated means, and ask for human review | Email us |
| Complain | Complain to us and to a supervisory authority | See section 6 |
2. How to make a request
In the app. Most requests can be completed instantly in Settings > Privacy or Settings > Account.
By email. Write to [email protected] from the email address on your account. Tell us which right you are using and what you want. You do not need to use any particular form or quote the law. A template is at the bottom of this page if you find it helpful.
By post. SPEND PILOT LTD, 128 City Road, London, United Kingdom, EC1V 2NX.
Someone else, such as a solicitor or a relative, can make a request for you if they show us they have your authority.
3. Checking who you are
If a request comes from your account email or from inside the app, that is usually enough. If we cannot be sure a request is from you, we will ask for information to confirm your identity before acting, and we will not act until we are satisfied. We will never ask for your bank details or a copy of your passport for this purpose.
4. Timelines and cost
- We respond within one month of receiving your request.
- If a request is complex or you have made several, we may take up to two further months. We will tell you within the first month if that is the case and why.
- Where we need to confirm your identity or ask you to clarify what you want, the time limit pauses until you reply.
- Requests are free. If a request is manifestly unfounded or excessive, for example because it repeats one we have just answered, we may charge a reasonable fee or refuse it, and we will explain why.
- When we search for your data in response to an access request, we carry out a reasonable and proportionate search.
5. What happens when you delete your account
- Your account, profile, dietary selections, plans, lists, baskets and spending history are deleted within 30 days.
- Deleted data leaves our backups within [30] days after that. [CONFIRM BACKUP CYCLE]
- We keep only what the law requires us to keep, for example records needed for tax or to defend a legal claim, and anonymised statistics that cannot identify you.
- If you are on the waitlist, unsubscribe using the link in any email or ask us to remove you.
6. Complaints
You have the right to complain directly to us if you think we have handled your personal data badly.
How. Email [email protected] with the subject line "Complaint", or use the Privacy complaint form in Settings > Privacy. Tell us what happened and what you would like us to do.
What we do. We acknowledge every complaint within 30 days, and normally within 5 working days. We investigate, keep you informed, and aim to give you a full response within one month. If it will take longer we will tell you why.
If you are still unhappy, or at any time, you can complain to the regulator:
United Kingdom. Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. ico.org.uk/make-a-complaint.
European Economic Area. The data protection authority in the country where you live or work, or where the problem happened. A list is available from the European Data Protection Board at edpb.europa.eu.
You can also bring a claim in court.
7. Request template
You do not have to use this. Any clear request will do.
Subject: Data rights request
My account email address: [EMAIL]
I would like to: [access my data / correct my data / delete my data / restrict processing / receive a portable copy / object to processing / withdraw consent / request human review]
Details: [ANYTHING THAT HELPS US, FOR EXAMPLE WHAT DATA OR WHICH PERIOD]
Name: [YOUR NAME] Date: [DATE]
8. Contact
Still have questions?
[email protected]