Your privacy rights and how to use them

1. Your rights

• Access: confirmation of whether we process your personal data, and a copy of it with information about how we use it.
• Export and portability: your data in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means.
• Rectification: correction of inaccurate or incomplete data.
• Erasure: deletion of your data where the law gives you that right (for example it is no longer needed, or you withdrew consent). We may keep data we must retain by law, such as invoices.
• Restriction: asking us to pause processing while you contest accuracy or an objection is being checked.
• Objection: objecting to processing based on legitimate interests, and at any time to direct marketing.
• Withdrawal of consent: at any time, with effect for the future. Withdrawing does not affect processing done before. For newsletters, use the unsubscribe link in any email.
• No solely automated decisions: we do not make decisions about individuals that produce legal or similarly significant effects based solely on automated processing.

2. Opt-out of sale or sharing

We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are defined in California and other US state laws. There is therefore nothing to opt out of, and we do not need a “Do Not Sell or Share” link. We honour the Global Privacy Control signal. See Cookie settings.

3. California (CCPA/CPRA) and other US states

We honour the rights these laws describe even where they do not yet legally apply to us: to know what personal information we collect, use and disclose; to access and port it; to correct it; to delete it; to limit use of sensitive personal information (we do not use it beyond what is needed to provide the service); and to not be discriminated against for exercising your rights.

You may use an authorised agent. We may ask for written proof of the agent's authority and verify your identity directly.

4. India (DPDP Act, 2023)

If you are in India you also have the right to access information about your data, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights if you die or become unable to. See our India notice, which also names the Grievance Officer.

5. EEA, UK and Switzerland

The UK GDPR gives UK residents the same rights as in section 1, and you may complain to the Information Commissioner's Office (ico.org.uk). People in the EEA and Switzerland have the rights in section 1 under the GDPR as applicable. Write to privacy@bhoral.com for any EU, UK or Swiss matter.

6. How to make a request

In the product. If you have a Bhoral account, sign in to the app and open Settings, then Privacy, to download your personal data export yourself or to submit an erasure request. This is the fastest route and also helps us verify who you are.

By email. Write to privacy@bhoral.com from the email address linked to your account if you have one. Tell us which right you want to use and, if helpful, which country or state you live in. You can open a prefilled email to make this easier.

You do not need to give a reason, and you do not need to use any particular wording.

7. What we do with your request

• Verify your identity. We confirm the request comes from the person it concerns, usually by replying to the email address on the account. If we cannot reasonably tell, we may ask for limited extra information, and we will not ask for more than we need.
• Answer in time. We respond within the time the law allows. Under the GDPR (for people in the EEA and UK) that is one month, extendable by up to two further months for complex or numerous requests, in which case we tell you why within the first month. Under US state laws it is generally 45 days, extendable once where reasonably necessary, and we respond to US requests within that time. Under the DPDP Act we aim to resolve within 90 days at the latest.
• Charge no fee. Requests are free. We may charge a reasonable fee or decline only where a request is manifestly unfounded or excessive, and we will explain.
• Tell you the outcome. If we cannot fully comply, we say why and tell you how to complain.

8. What we cannot do ourselves

For customer data in databases, files and tools that a company connects to Bhoral, that company is the controller and we are its processor. If your data is in such a workspace, we cannot decide on your request ourselves. We will pass it to the customer without undue delay and tell you we have done so, and we will help the customer respond as our Data Processing Agreement requires. It is often quicker to contact the company you deal with directly.

We may also refuse or limit a request where the law allows or requires it, for example where data must be kept for tax law, to defend legal claims, or where providing it would reveal other people's personal data.

9. Complaints

Please contact us first so we can try to put things right. If you are in the EEA, UK or Switzerland you have the right to complain to your local data protection supervisory authority, where you live or work or where the alleged infringement took place.

UK: Information Commissioner's Office. US: your state attorney general. India: the Data Protection Board of India, after using our grievance process. California: the California Attorney General or California Privacy Protection Agency.