1. Available requests
Subject to applicable law and the circumstances of processing, a person may request:
- A summary of personal data being processed and relevant processing activities.
- Correction of inaccurate or misleading data, completion of incomplete data and updating of data.
- Erasure of personal data where it is no longer required and no legal or contractual retention ground applies.
- Withdrawal of consent, with comparable ease to the method used to give consent.
- Information regarding categories of recipients or processors, where required by law.
- Nomination of another individual to exercise rights in the event of death or incapacity, where applicable.
- Review and redress of a privacy grievance.
2. How to submit a request
Email business@lilyinasia.com with the subject “Privacy Request” or “Privacy Grievance”. Include your full name, email address or telephone number used in the interaction, the relevant form, project, event or communication, and the specific action requested. Postal requests may be sent to the registered office.
3. Verification
We may request proportionate information to verify identity, authority and the relevant interaction. This protects personal data against unauthorised disclosure or deletion. An authorised representative may be required to provide proof of authority.
4. Response timeline
We aim to acknowledge a request within seven business days and provide a substantive response within thirty days where reasonably possible. Complex requests may require more time, but we will communicate the reason and expected timeline. In all cases we will act within the period required by applicable law, which may permit a period of up to ninety days for grievance response.
5. Limits and refusals
A request may be limited or refused where it is manifestly unfounded, repetitive, disproportionate, affects another person’s rights, compromises security or confidentiality, relates to privileged material, or conflicts with a legal, contractual, regulatory or record-retention obligation. Reasons will be provided where required.
6. Escalation
If you are dissatisfied, reply to the response and request escalation to the Compliance and Privacy Contact. Where the Digital Personal Data Protection Act and related provisions apply, a complaint may be made to the Data Protection Board of India after the internal grievance mechanism has been used, subject to the applicable procedure.
7. No retaliation and no ordinary fee
We do not retaliate against a person for making a genuine privacy request. No fee is ordinarily charged, although a reasonable fee may be requested where permitted for excessive or repetitive requests.