Data Subject Rights Policy

How to exercise your GDPR and CCPA rights regarding your personal data.

Updated May 5, 2026 Version 1.0

This Data Subject Rights Policy explains your rights under GDPR (EU/UK) and CCPA (California) and provides step-by-step instructions for exercising those rights.

Related policies: Privacy Policy · Account Deletion Policy · Data Retention Schedule

1. Overview

As a user of Spencer's Website, you have specific rights regarding your personal data. These rights are granted by:

  • GDPR (General Data Protection Regulation): Applies to users in the European Union and United Kingdom
  • CCPA (California Consumer Privacy Act): Applies to residents of California, USA
  • Other privacy laws: Various other jurisdictions may grant similar rights

This policy provides clear, actionable steps to exercise each of these rights.

2. Your Rights

2.1 Right to Access

You have the right to know what personal data we have collected about you, including:

  • Categories of personal data collected
  • Purposes for which we use your data
  • Categories of third parties with whom we share data
  • Specific pieces of personal data we hold about you

2.2 Right to Deletion (Right to be Forgotten)

You have the right to request deletion of your personal data, with certain exceptions for legal, security, or operational requirements.

2.3 Right to Rectification

You have the right to correct inaccurate or incomplete personal data we hold about you.

2.4 Right to Portability

You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another service provider.

2.5 Right to Restrict Processing

You have the right to request that we limit how we use your personal data.

2.6 Right to Object

You have the right to object to certain types of data processing, particularly processing based on legitimate interest.

2.7 Right to Opt-Out of Sale (CCPA)

California residents have the right to opt-out of the sale of their personal information. Note: We do not sell personal data.

2.8 Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights.

3. How to Exercise Your Rights

3.1 Right to Access

Method 1: Self-Service (Fastest)

  1. Log in to your account
  2. Navigate to Settings > Privacy > Export Data
  3. Click "Download My Data"
  4. Your data will be generated and available for download within 24 hours

Method 2: Email Request

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "Data Access Request"
  3. Include your username and email address
  4. We will verify your identity and provide your data within 30 days

3.2 Right to Deletion

Method 1: Self-Service

  1. Log in to your account
  2. Navigate to Settings > Account > Delete Account
  3. Follow the deletion process
  4. Your account and data will be deleted within 30 days

See our Account Deletion Policy for detailed instructions.

Method 2: Email Request

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "Data Deletion Request"
  3. Include your username and email address
  4. Specify what data you want deleted (all or specific categories)

3.3 Right to Rectification

  1. Log in to your account
  2. Navigate to Settings > Profile
  3. Update your information directly
  4. Click "Save Changes"

For data not editable in your profile, email us with the correction request.

3.4 Right to Portability

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "Data Portability Request"
  3. Specify the format you prefer (JSON, CSV, XML)
  4. We will provide your data in the requested format within 30 days

3.5 Right to Restrict Processing

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "Data Restriction Request"
  3. Specify which data processing you want restricted
  4. We will implement restrictions where legally possible

3.6 Right to Object

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "Data Processing Objection"
  3. Explain your grounds for objection
  4. We will review and respond within 30 days

3.7 Right to Opt-Out of Sale (CCPA)

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "CCPA Opt-Out Request"
  3. We will confirm within 45 days that we do not sell your data

Note: We do not sell personal data. This right is provided for transparency and future-proofing.

4. Verification Process

4.1 Why We Verify

To protect your privacy and security, we verify your identity before fulfilling requests that involve accessing or deleting personal data.

4.2 Verification Methods

  • Account holders: We verify by requiring you to log in to your account
  • Email requests: We may ask you to confirm your email address or provide additional verification
  • Authorized representatives: We may request proof of authorization (e.g., power of attorney)

4.3 What We Need

When submitting a request by email, please provide:

  • Your username
  • Your registered email address
  • A brief description of your request
  • Any relevant account information (optional)

5. Response Times

5.1 Standard Response Times

  • Access requests: Within 30 days (extendable by 60 days for complex requests)
  • Deletion requests: Within 30 days
  • Rectification requests: Within 30 days
  • Portability requests: Within 30 days
  • Restriction/Object requests: Within 30 days
  • CCPA opt-out requests: Within 45 days

5.2 Complex Requests

If your request is complex or involves large amounts of data, we may need additional time. We will inform you of any extension and the reason for it.

5.3 No Response

If you do not receive a response within the specified time, please follow up with us. We will investigate and respond promptly.

6. Appeals Process

6.1 When to Appeal

You may appeal if:

  • Your request is denied
  • We do not respond within the specified timeframe
  • You are dissatisfied with our response

6.2 How to Appeal

  1. Send an email to support@thespencerwebsite.com
  2. Subject line: "Data Rights Appeal"
  3. Include your original request details
  4. Explain why you believe our decision was incorrect

6.3 Appeal Review

  • Your appeal will be reviewed by a different team member than the original reviewer
  • We will respond within 30 days of receiving your appeal
  • If we uphold our decision, we will explain our reasoning

6.4 External Review

If you remain unsatisfied, you may:

  • File a complaint with your local data protection authority
  • Seek legal recourse through the courts
  • Contact the relevant regulatory body for your jurisdiction

7. Third-Party Data

7.1 Data Shared with Third Parties

We share some data with third-party service providers (Stripe, Groq, Google). To exercise your rights regarding data held by these providers, you must contact them directly:

7.2 Our Role

We will assist you in exercising your rights with third parties to the extent required by law and within our control.

8. Contact

For questions about your data rights or to submit a request, contact us:

Email: support@thespencerwebsite.com

Subject lines:

  • Data Access Request
  • Data Deletion Request
  • Data Rectification Request
  • Data Portability Request
  • Data Restriction Request
  • Data Processing Objection
  • CCPA Opt-Out Request
  • Data Rights Appeal