Data Subject Rights

We are committed to transparency, accountability, and the protection of personal data. This page explains the rights available to data subjects under applicable data protection laws, the manner in which those rights may be exercised, and how personal data is processed when we act as a controller or as a processor/service provider.

1. Who Is a Data Subject

A data subject is any identified or identifiable natural person whose personal data is processed. An identifiable person is one who can be identified, directly or indirectly, by reference to identifiers such as a name, identification number, online identifier, location data, or other factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

Data subjects may include, without limitation:

a) Visitors to our websites
Users of our platforms or services
Client representatives, employees, or contacts
End users whose personal data is processed as part of client engagements

Depending on the context and nature of processing, we may act either as a data controller (determining the purposes and means of processing) or as a data processor/service provider (processing personal data strictly on documented instructions).

2. Overview of Data Subject Rights

The rights available to data subjects vary depending on jurisdiction, applicable law, and processing context.

Applicable Law	Who It Applies To	Key Rights Available
GDPR (EU & UK)	Individuals in EU & UK	Informed, access, rectification, erasure, restriction, portability, objection, automated decision safeguards
DPDP Act, 2023 (India)	Individuals whose data is processed in India	Access, correction, erasure, grievance redressal, nomination
CCPA / CPRA (California)	California residents	Know, access, delete, correct, limit sensitive data use, non-discrimination
Israel Privacy Law	Individuals subject to Israeli law	Review, correction, deletion, database transparency
Mexico LFPDPPP	Individuals whose data is processed in Mexico	ARCO rights (Access, Rectification, Cancellation, Opposition)

3. Rights Under the GDPR (EU & UK)

If you are located in the European Union or the United Kingdom, you are entitled to the
following rights under the GDPR:

.Right to Be Informed. You have the right to receive clear and accessible information about how and why your personal data is processed, including purposes, legal basis, retention periods, recipients, international transfers, and available rights.
Right of Access. You may request confirmation of whether your personal data is processed and obtain a copy of such data along with information about the processing activities.
Right to Rectification. You may request correction of inaccurate personal data and completion of incomplete data to ensure accuracy.
Right to Erasure. You may request deletion of personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful, subject to legal retention or claim obligations.
Right to Restrict Processing. You may request temporary restriction of processing while accuracy or legality is contested.
Right to Data Portability. Where processing is based on consent or contract, you may receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object. You may object to processing based on legitimate interests or for direct marketing purposes.
Automated Decision-Making Rights. You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, except where permitted by law with safeguards.

4. Rights Under India’s Digital Personal Data Protection Act, 2023

If your personal data is processed in India, you are entitled to the following rights under the Digital Personal Data Protection Act, 2023:

Right to Access Information. You have the right to obtain information about the personal data being processed, the purposes for which such data is processed, and other details as prescribed under applicable law.
Right to Correction. You may request correction of inaccurate, incomplete, or misleading personal data to ensure that the information processed is accurate and up to date.
Right to Erasure. You may request erasure of personal data that is no longer required for the purpose for which it was collected or processed, subject to applicable legal and regulatory obligations.
Right to Grievance Redressal. You have the right to raise grievances regarding the processing of your personal data and to receive a reasoned response within the timelines prescribed under the Act.
Right to Nominate. You may nominate another individual to exercise your rights under the Act in the event of your death or incapacity, in accordance with applicable law.

5. Rights Under the CCPA / CPRA (California, USA)

If you are a California resident, you are entitled to the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know. You have the right to request disclosure of the categories and specific pieces of personal information collected, used, disclosed, or otherwise processed, as well as the purposes of such processing.
Right to Access. You may request access to specific pieces of personal information collected about you, subject to verification requirements.
Right to Delete. You may request deletion of personal information, subject to statutory exceptions, including where retention is required for legal, security, or operational purposes.
Right to Correct. You may request correction of inaccurate personal information maintained about you.
Right to Limit Use of Sensitive Personal Information. You may limit certain uses and disclosures of sensitive personal information, as defined under applicable law.
Right to Non-Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights, including denial of services, differential pricing, or reduced service quality.

6. Rights Under Israel’s Protection of Privacy Law

If your personal data is subject to Israeli law, you are entitled to the following rights under the
Protection of Privacy Law, 1981:

Right to Review. You have the right to review personal data stored about you in registered databases, including information relating to the purposes of data collection.
Right to Correction or Deletion. You may request correction, updating, or deletion of personal data that is inaccurate, incomplete, outdated, or misleading.
Right to Protection Against Unlawful Use. You have the right to expect that your personal data will not be used, disclosed, or transferred in a manner that violates Israeli privacy law or exceeds the purposes for which it was collected.
Right to Database Transparency. You have the right to obtain information regarding whether a database is registered and the purposes for which personal data contained in the database is processed.

7. Rights Under Mexico’s LFPDPPP (ARCO Rights)

If your personal data is processed in Mexico, you are entitled to the following rights under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), collectively referred to as the ARCO rights, along with related statutory protections:

Right of Access You have the right to confirm whether personal data concerning you is being processed and to obtain access to such data, as well as information regarding its origin, use, and purposes.
Right to Rectification You may request correction of personal data that is inaccurate, incomplete, or outdated, ensuring that the information processed remains accurate and reliable.
Right to Cancellation You may request deletion of personal data when processing is no longer necessary for the purposes for which it was collected, or where processing is not carried out in accordance with applicable law, subject to legal retention requirements.
Right to Opposition You may object to the processing of your personal data for specific purposes where such processing is not required by law and may cause harm or prejudice.
Right to Limit Use and Disclosure You may request limitations on the use or disclosure of your personal data, particularly where such data is used for secondary purposes.
Right to Withdraw Consent Where processing is based on consent, you may withdraw such consent at any time, without retroactively affecting the lawfulness of prior processing.
Right to Privacy Notice You have the right to be informed, through a privacy notice, about how your personal data is collected, used, stored, transferred, and protected.

8. How to Exercise Your Rights

You may exercise your data subject rights by contacting us at:

📧 [email protected]

Please include your name, contact details, the right you wish to exercise, and sufficient information to identify the data concerned. Identity verification may be required.

9. Processing on Behalf of Clients

a) The client acts as Controller / Business
b) We act as Processor / Service Provider

Requests relating to such data may need to be routed through the relevant client. We assist clients in fulfilling data subject rights as contractually agreed.

10. Data Processing Addendum (DPA)

Data Processing Addendum

Where we process personal data on behalf of another party, such processing is governed by the following Data Processing Addendum, which forms an integral part of the applicable agreement.