Subject Access Request Procedure

1. Who can make a request

• Any individual whose personal data is processed by Class Prayer.
• A person with parental responsibility on behalf of a child where the child is unable to act for themselves (typically under 12, but assessed individually).
• A representative acting under written authority.

2. Self-serve options (Articles 15 and 20)

Authenticated staff users can fulfil their own right of access and right to data portability directly from the Profile page:

• Download my data returns a JSON file containing every record we hold against the account.
• Delete my account initiates erasure (Article 17), with permanent purge inside 30 days.

3. Submitting a manual request

• Email info@classprayer.app with the subject line "SAR — [name]".
• Tell us which rights you wish to exercise (access, rectification, erasure, restriction, objection, portability, withdrawal of consent).
• Provide enough information for us to find your records (school name, role, account email) — we do not need extra ID unless we have reasonable doubt about your identity.

4. Identity verification

Where reasonable doubt exists we may ask you to confirm details only the data subject would know (e.g. last sign-in date, school code, account creation date). We do not require copies of passports or driving licences as a default — proportionality applies (ICO guidance on right of access).

5. Timeframe and fees

• We respond within one calendar month of receipt (Article 12(3)).
• We may extend by a further two months for complex or numerous requests, telling you within the first month.
• There is no fee. We may charge a reasonable administrative fee, or refuse, only where the request is manifestly unfounded or excessive — and we will tell you why.

6. What you receive

• Confirmation of whether we process your personal data.
• A copy of the personal data in a structured, commonly used, machine-readable format (usually JSON; CSV on request).
• Information about the purposes, categories, recipients, retention, and the rights set out in Articles 15(1)–(2).

7. Refusal grounds

• Information that would adversely affect the rights and freedoms of others (Article 15(4)).
• Information subject to legal privilege.
• Requests that are manifestly unfounded or excessive (Article 12(5)).

If we refuse, we explain why and how to complain to the ICO at ico.org.uk.