Subject Access Request Procedure

1. What is a Subject Access Request?

Under Article 15 of the UK GDPR, you have the right to obtain confirmation from GRAM Systems as to whether or not personal data concerning you is being processed, and where that is the case, access to that personal data along with details regarding:

• The purposes of the processing.
• The categories of personal data concerned.
• The recipients or categories of recipients to whom the data has been or will be disclosed.
• The envisaged period for which the data will be stored, or criteria used to determine that period.

2. How to Submit a Request

You can submit a Subject Access Request to Matthew Hudson using either of the following channels:

Please include the words "Subject Access Request" in the subject line of your email or written correspondence.

3. Information We Need to Process Your Request

To help us identify your records quickly, please provide:

• Your full name and primary email address.
• The organisation you represent or were affiliated with when interacting with GRAM Systems or Roger That!.
• A clear description of the specific information you are requesting (e.g. user account details, communications history).

4. Identity Verification

To protect the confidentiality of your personal data and prevent unauthorized disclosure, we must verify your identity before releasing any records. We may ask you to confirm your email address or provide a standard form of identification.

5. Timescales & Fees

Fee: In accordance with the UK GDPR, all standard Subject Access Requests are processed completely free of charge.

Timescale: We will provide your records without undue delay and at the latest within one calendar month from the date we receive your verified request. In the event of an exceptionally complex request, this period may be extended by up to two additional months, and we will inform you of the extension within the initial month.

6. Client Data as Data Processor

Where your personal data is contained within an active client organisation's operational database (such as an offshore equipment sign-off on a vessel spread), the client organisation is the Data Controller.

In such cases, we will inform you and coordinate with the client organisation's designated Data Protection Officer to facilitate your request in accordance with the law.

7. Right to Complain to the ICO

If you are dissatisfied with how your request has been handled, you have the statutory right to lodge a complaint with the UK Information Commissioner's Office: