Data Rights Policy

About this document

Citizen Centric Data Rights Policy

How to exercise your data-protection rights and raise a complaint.

Publication details

Operator — Politis Ltd (company number 13661766)

Version — 1.1

Effective date — 18 August 2026

Important information

For information collected for a research study, the research organisation named in the study privacy notice is normally the controller and decides how a rights request is handled. Politis Ltd will provide reasonable assistance when acting as processor.

Scope

This policy explains how individuals may exercise rights under the UK GDPR and Data Protection Act 2018 in connection with Citizen Centric. It complements the Platform Privacy Notice and the privacy information supplied for each study.

To be informed

You are entitled to clear information about how personal information is collected and used. The Platform Privacy Notice and study-specific information provide this.

Access

You may ask whether your personal information is being processed and request a copy together with supporting information about the processing.

Rectification

You may ask for inaccurate personal information to be corrected and incomplete information to be completed.

Erasure

You may ask for personal information to be erased in circumstances set out in law, including where it is no longer needed or consent is withdrawn where consent is the lawful basis. This right is not absolute.

Restriction

You may ask for processing to be restricted in circumstances set out in law, including while accuracy or an objection is being considered.

Data portability

Where processing is automated and based on consent or contract, you may be entitled to receive personal information you provided in a structured, commonly used and machine-readable format, or ask for it to be transmitted to another controller where technically feasible.

Automated decisions

Where a solely automated decision has legal or similarly significant effects, you may have rights to obtain human intervention, express your point of view and contest the decision. Citizen Centric does not use AI as the sole basis for such decisions about participants.

Important information

You may object to processing based on legitimate interests or a public task. The controller must stop unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims. An objection to direct marketing is absolute; Citizen Centric does not use participant information for direct marketing.

Limits and exemptions

Rights depend on the purpose and lawful basis for processing and may be subject to statutory conditions or exemptions. A research exemption is not automatic: the controller must assess whether its legal requirements are met in the particular circumstances.

• Irreversibly anonymised information is not personal information and cannot be linked back to an individual by reasonably available means.
• Pseudonymised information remains personal information and continues to be protected.
• A response may need to protect the rights and confidentiality of another person, including through proportionate redaction.
• Information may be retained where erasure is not required, including to meet legal obligations, establish or defend legal claims, or where a valid research-related exemption applies.

How to make a request

A request may be made in the app where the relevant option is available, by contacting the controller named in the study-specific privacy notice, or by contacting Politis Ltd using the details below. You do not need to use special wording or a particular form.

Please explain which right you wish to exercise and provide enough information to identify the relevant account, organisation or study. Do not send a password, full invitation code, session token or verification code by email.

We may request information reasonably necessary to confirm identity or authority. We will not request more identification than is proportionate to the risk.

Response times

A valid rights request will be handled without undue delay and normally within one month of receipt, or within one month after receiving information reasonably required to confirm identity or authority. The exact deadline is calculated by calendar month, not as a fixed 30-day period.

The period may be extended by up to a further two months where a request is complex or the same person has made a number of requests. If an extension is needed, the requester will be told within the initial one-month period and given the reasons.

Where clarification is reasonably required to identify the information or processing requested, the response clock may pause while clarification is awaited. Advice and assistance will be provided to help clarify the request.

Study Data and processor assistance

The study controller determines the substantive response to a request about Study Data. If Politis Ltd receives such a request while acting as processor, it will route the request securely to the relevant controller and assist in accordance with the applicable Data Processing Agreement. Politis Ltd decides requests relating to processing for which it acts as controller.

Children and people needing support

Data-protection rights belong to children as well as adults. Whether a child can exercise a right directly, or whether a person with parental responsibility or another authorised representative may act, depends on the child's understanding, the circumstances and applicable law. Information and assistance will be provided in an accessible and age-appropriate way where reasonably required.

A person may authorise someone else to act for them. Reasonable evidence of authority may be requested before information is disclosed.

AI-assisted processing

Approved AI-assisted functions may support transcription, translation, thematic organisation, summarisation and search. Outputs are research-assistance tools subject to human review. Participant material is not used to train public or shared foundation models, and active study-specific AI processing must be disclosed in the relevant study information.

Data-protection complaints

A concern about the handling of personal information may be raised with the relevant study controller or with Politis Ltd. A complaint does not need to use legal terminology. It should describe the concern and provide enough information for it to be investigated.

You may complain to the Information Commissioner's Office at any time. Visit https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. You do not have to complete Politis Ltd's complaints process first.

• Politis Ltd will provide a clear route for making a data-protection complaint.
• The complaint will be acknowledged within 30 days of receipt.
• Appropriate steps will be taken to investigate it without undue delay.
• The complainant will be kept appropriately informed and told the outcome.

Contact and updates

Politis Ltd The Old Courthouse, Orsett Road, Grays, Essex, England, RM17 5DD Email: info@politisconsulting.co.uk ICO registration reference: ZB738312

Material changes to this policy will be versioned and published with an updated effective date.