Subject Access Request (SAR) Procedure
Purpose
This procedure explains how requests for personal data are handled by Wholefoods1st in accordance with UK GDPR and Data Protection legislation.
How to Make a Request
Individuals may submit a Subject Access Request by:

• Emailing: [email protected]

The request should include sufficient information to identify the individual and the information being requested.
Identity Verification
Before releasing personal information, reasonable proof of identity may be requested.
Accepted forms of identification may include:

• Passport
• Driving licence
• Utility bill
• Other reasonable identification documents

Timeframe
Requests will normally be responded to within one calendar month of:

• Receiving the request, and
• Receiving satisfactory identification (where required)

If the request is complex, the response period may be extended in accordance with applicable legislation.
Information Provided
The response may include:

• Confirmation whether personal data is held
• Copies of relevant personal data
• Information about how the data is processed
• Information about retention periods and rights

Exemptions
Certain information may be withheld where exemptions apply under data protection law.
Record Keeping
A record of all Subject Access Requests and responses will be maintained securely.