Your data protection rights under the UK General Data Protection Regulation (UK GDPR).
Pink Chilli is registered with the Information Commissioner's Office (ICO) as a data controller.
You can verify our registration on the ICO Data Protection Register.
Under the UK GDPR, you have the following rights regarding your personal data:
Right of Access
Art. 15
Request a copy of all personal data we hold about you.
Right to Rectification
Art. 16
Request correction of inaccurate or incomplete data.
Right to Erasure
Art. 17
Request deletion of your personal data.
Right to Restrict Processing
Art. 18
Request that we limit how we use your data.
Right to Data Portability
Art. 20
Receive your data in a machine-readable format.
Right to Object
Art. 21
Object to processing based on legitimate interest.
Use this form to exercise your data protection rights. Your request will be routed to our Data Protection Officer who will respond within 30 days.
If you believe we have not handled your personal data appropriately, we encourage you to follow this escalation pathway:
Contact our DPO
Email dpo@pinkchilli.io or use the complaint form above. We aim to resolve all complaints within 30 days.
Internal Review
If you are not satisfied with the DPO's response, request an internal review by a senior member of management. We will acknowledge your escalation within 5 working days.
Escalate to the ICO
If you remain dissatisfied after our internal process, you have the right to lodge a complaint with the Information Commissioner's Office:
We retain data only as long as necessary. Our automated retention enforcement system flags records that are due for deletion per this schedule.
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Account data | Active account + 30 days | Contract |
| Audit logs | 90 days | Legitimate interest |
| Usage events | 180 days | Consent |
| Financial records | 7 years | UK legal obligation |
| Tenancy records | Tenancy duration + 6 years | Limitation Act 1980 |
| Compliance documents | Tenancy duration + 6 years | Legal obligation |
| Email/SMS logs | 30 days | Contract |
| Data subject requests | 3 years from resolution | Legal obligation |