DATA SUBJECT ACCESS REQUEST PROCEDURE

 

Agard Research Associates Inc.

A New Jersey Nonprofit Corporation

Effective Date: March 4, 2025

Last Updated: August 25, 2026

​

​

1. PURPOSE AND SCOPE

 

This Procedure explains how to ask Agard Research Associates Inc. to act on your personal data, and what we do once you ask. It applies to every request we receive about personal data we hold, whatever privacy law that request is made under and whether or not that law applies to us.

​

We treat requests uniformly. We do not require you to establish that a particular statute covers you before we will act, and we do not narrow our response to the minimum a statute would compel. Where a right exists under law that applies to us, we honor it because it is owed. Where it does not, we generally honor it anyway as a matter of practice.

​

This Procedure sits alongside our Privacy Policy, which describes what personal data we collect and why. Read that document first if you want to know what we hold before deciding what to ask for.

​

2. WHAT YOU CAN ASK FOR

 

Depending on your location and the circumstances, you may ask us to do any of the following:

• Confirm and access. Tell you whether we are processing personal data about you and give you a copy of it.

• Correct. Fix personal data about you that is inaccurate or incomplete.

• Delete. Delete personal data we hold about you.

• Port. Provide a copy of your personal data in a structured, commonly used, machine-readable format, where the processing is carried out by automated means.

• Opt out. Stop processing your personal data for targeted advertising, for sale, or for profiling that produces legal or similarly significant effects. We do not sell personal data or conduct targeted advertising, so an opt-out request will usually be confirmed rather than acted upon.

• Withdraw consent. Withdraw consent you previously gave, where consent is the basis on which we process. Withdrawal does not undo processing that was lawful before you withdrew.

• Object or restrict. Object to processing based on our legitimate interests, or ask us to restrict processing while a dispute about accuracy or lawfulness is resolved.

 

You will not be treated differently, denied services, or charged a different price because you exercised any of these rights.

​

3. HOW TO SUBMIT A REQUEST

 

You may submit a request by any of the following means. No particular form of words is required, and you do not need to cite a statute.

​

Online form: https://www.agardresearchassociates.org/privacy-data-requests

Email: data@agardresearchassociates.org

Postal: Agard Research Associates Inc., Attn: Privacy Officer, 859 US Highway 130, Ste 5 PMB 5020, East Windsor, NJ 08520-2900, United States

​

So that we can act quickly, it helps if you tell us your name, an address at which we can reach you, which right you are exercising, and any detail that would help us locate the relevant records. If you leave something out, we will ask rather than refuse.

​

REQUESTS MADE BY AN AUTHORIZED AGENT

 

You may use an authorized agent to submit a request on your behalf. We will ask the agent for written authorization signed by you, and we may contact you directly to confirm that you gave that authorization and that you understand the scope of the request. We will not require this of an agent acting under a valid power of attorney or as a duly appointed conservator or guardian.

​

OPT-OUT SIGNALS

 

We honor the Global Privacy Control and other recognized universal opt-out mechanisms. If your browser or device transmits such a signal, we treat it as a valid opt-out request for that browser or device. You do not need to contact us or verify your identity to use one.

​

4. THE PROCEDURE

 

STEP 1. ACKNOWLEDGMENT

 

We acknowledge receipt of your request within ten business days, confirm what we understand you to be asking for, and tell you what happens next. If we have misread your request, this is the point at which to correct us.

​

STEP 2. VERIFICATION OF IDENTITY

 

Before we disclose, correct, or delete personal data, we verify that the request comes from you. This protects you, not us: acting on an unverified request is itself a data breach.

​

The verification we ask for is proportionate to the sensitivity of the data involved. Confirming a detail already in our records is often enough. For requests involving sensitive personal data or research participation records, we may ask for more. We do not retain information collected solely for verification beyond the period needed to complete it, and we do not use it for any other purpose.

​

An opt-out request does not require verification. We act on it as submitted.

​

STEP 3. ASSESSMENT

 

Once verified, we determine what we hold, whether the right you have asserted applies to that data, and whether any exception requires us to retain or withhold it. Common reasons we may be unable to act in full include:

• A legal or regulatory obligation to retain the record, including donation and financial records retained for tax purposes

• An active legal hold, litigation, or investigation

• Data required to detect or prevent security incidents or fraud

• Research data that has been de-identified or aggregated and can no longer be linked to you

• Research records whose deletion would compromise the integrity of a study, where a retention period was disclosed in the consent form you signed

• Data whose disclosure would reveal personal data about another person or a trade secret

​

Where an exception applies to part of a request, we act on the remainder rather than refusing the whole.

​

STEP 4. RESPONSE

 

We respond within the period the applicable law prescribes. Where more than one period could apply, we use the shortest.

​

• Access, correction, deletion, and portability. We respond within 45 days of receiving a verifiable request. We may extend once by a further 45 days where reasonably necessary, and we will tell you before the first period ends.

• Opting out of sale, targeted advertising, or profiling. We act as soon as feasible, and no later than 15 days. There is no extension.

• Requests under the General Data Protection Regulation. We respond within one month of receipt. We may extend by two further months where the request is complex or numerous, and we will tell you within the first month.

• Appeal of a refusal. We respond within 45 days of receiving the appeal. There is no extension.

 

If we need an extension, we will tell you before the first period expires and explain why. We will not extend simply because a request is inconvenient.

​

STEP 5. DELIVERY

 

For an access request, we provide your personal data in a commonly used electronic format, transmitted securely. For a portability request, we provide it in a structured, machine-readable format. For a correction or deletion request, we confirm what was changed or deleted, and identify anything we retained together with the reason.

​

Where we have shared your personal data with a service provider or processor, we instruct them to act on your request as well, unless doing so is impossible or would involve disproportionate effort. Where that is the case, we tell you.

​

STEP 6. FEES

 

There is no charge for a request. We reserve the right to charge a reasonable fee, or to decline, where a request is manifestly unfounded, excessive, or repetitive. If we do either, we will tell you why and how to appeal.

​

5. IF WE REFUSE

 

If we decline a request in whole or in part, we will tell you which part we declined, the specific reason, and how to appeal.

​

APPEAL

 

You may appeal within 45 days of our decision by writing to data@agardresearchassociates.org with "Appeal" in the subject line, or by post to the address in Section 7. An appeal is reviewed by a person who was not responsible for the original decision.

We will respond in writing within 45 days of receiving your appeal, explaining the reasons for the decision. If we deny the appeal, we will provide a method by which you may contact the relevant supervisory authority.

​

COMPLAINT TO A SUPERVISORY AUTHORITY

​

• New Jersey residents. You may submit a complaint to the New Jersey Division of Consumer Affairs, Office of the Attorney General, at njconsumeraffairs.gov.

• Other United States residents. You may contact the office of the attorney general of your state.

• European Economic Area residents. You may lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

• United Kingdom residents. You may lodge a complaint with the Information Commissioner's Office at ico.org.uk.

 

You are not required to appeal to us before contacting a supervisory authority.

​

6. OUR INTERNAL HANDLING

 

The Privacy Officer receives, logs, and coordinates the response to every request. Each request is recorded with the date received, the identity verification performed, the assessment made, the action taken, the date of response, and any appeal. These records are retained in accordance with our Document Retention and Destruction Policy and are used to demonstrate compliance and to identify recurring problems in how we handle personal data.

​

Requests are not routed to, or decided by, the person whose conduct is the subject of the request.

​

7. CONTACT

 

Privacy Officer

Agard Research Associates Inc.

Email: data@agardresearchassociates.org

Telephone: +1 (732) 646-6497

Postal: 859 US Highway 130, Ste 5 PMB 5020, East Windsor, NJ 08520-2900, United States

​

The Privacy Officer is a position appointed by the Board of Directors under our Bylaws. Where the General Data Protection Regulation applies to our processing and the conditions requiring designation of a statutory data protection officer are met, the Board designates one and observes those conditions. Where those conditions are not met, the role is that of Privacy Officer, and we do not describe it as a statutory data protection officer.

​

8. RELATED POLICIES

​​

• Privacy Policy

• Cookie Policy

• Terms of Use

• Accessibility Statement

 

This Procedure is reviewed at least annually and upon any material change in our practices or in applicable law.

​

​

END OF DSAR PROCEDURE

​

Agard Research Associates Inc. | A New Jersey Nonprofit Corporation | EIN 33-3784865 | 859 US Highway 130, Ste 5 PMB 5020, East Windsor, NJ 08520-2900​