Data Access Request Policy

Short description: This policy explains how to request access to personal data held by Tanqory, including scope, eligibility, verification, what we provide or exclude, delivery, timelines, limitations, and appeals under GDPR/UK GDPR, Singapore PDPA, and relevant U.S. state privacy laws.

1) Purpose and scope (Purpose & Scope)

This policy covers how Tanqory handles data access requests (“Right of Access”/“Data Subject Access Request”). It applies to verified users and authorized agents and aligns with GDPR/UK GDPR, Singapore PDPA, and U.S. state access rights. Some data cannot be shared if it would infringe others’ rights, expose trade secrets, or breach law or contract. The English version controls; we update this policy when laws or services change.

2) Rights and guiding principles (Rights & Principles)

• Right to know and access: Request confirmation, a copy of your personal data, and key details (purpose, categories, recipients, storage periods, legal bases, rights).
• Transparency: We respond in clear, concise language and correct inaccuracies we identify where appropriate.
• Protecting others: Redaction, aggregation, or summaries are used to avoid exposing others’ data or confidential information.
• Fair use: Manifestly unfounded, excessive, or repetitive requests may be narrowed, delayed, or charged where law permits, with written reasons.
• No automatic deletion: Access does not close or delete your account.
• Non-discrimination: We do not penalize you for exercising access rights.
  Supplementary information provided with access responses: We include (where applicable) the purposes of processing; categories of personal data; recipients/recipient categories (including third-country recipients); storage periods or the criteria used; legal bases; the rights available (access, rectify, erase, restrict, object, portability where applicable); the right to lodge a complaint with a supervisory authority; the source of data if not collected from you; whether we conduct automated decision-making/profiling and, if so, meaningful information on the logic and expected effects; and cross-border transfer safeguards (e.g., SCCs/BCRs) and how to request a copy. For CPRA/other U.S. state laws we also indicate whether data (including sensitive personal information) was “sold” or “shared” and to which categories of third parties.

3) How to submit and how we verify (Channels & Verification)

• Where to submit: Email privacy@tanqory.com with the subject "Data Access Request" (primary channel). A self-service web portal is on Tanqory's data-rights roadmap; until it launches, all access requests are handled manually by the Privacy team with the statutory response timelines stated below.
• What to include: Sign-up email, scope (e.g., profile, billing history, API logs), date range if helpful, preferred format/delivery channel.
• Verification: MFA plus checks against registered email/phone. Higher-risk cases may require extra proof (e.g., government ID, domain control).
• Authorized agents: Provide authority plus ID for the account holder and the agent; incomplete or inconsistent documents pause or deny the request with reasons.
• Delivery: One-time links with short expiry, dedicated SFTP, or scoped API endpoints with limited privileges, sent only to verified channels. Audit trails and verification evidence are retained.

4) Data contents and exclusions (Data Contents & Exclusions)

Typical data we provide (subject to scope and feasibility): account profile/preferences; account/store/domain settings; abbreviated activity logs (logins, feature toggles, config changes); orders/transactions owned by the requester with third-party data redacted; support interactions tied to the requester; integrations created by the requester; API usage logs with non-secret keys; security settings (MFA devices, limited login history); billing summaries excluding full card details.

Regional disclosures and look-back periods:

• GDPR/UK GDPR: supplementary information listed in Section 2 (purposes, categories, recipients, storage periods/criteria, rights, complaint route, source, automated decision-making/profiling, and cross-border safeguards).
• Singapore PDPA: where required, we disclose how personal data has been used or disclosed within the prescribed period (e.g., past year) and the circumstances of collection if not collected directly.
• CPRA/other U.S. state laws: we disclose categories and specific pieces collected in the past 12 months, categories of sources, purposes, and categories of third parties to whom personal data (including sensitive personal information) was sold/shared/disclosed.

Data we do not provide (or will redact/aggregate): full PAN/CVV, secret API keys, encryption material or other credentials; data revealing other users/buyers/third parties without legal basis; proprietary algorithms, source code, internal security controls, or confidential business information under NDAs; data barred by law, legal holds, court orders, or third-party duties (e.g., PCI DSS); derived analytics that cannot be isolated without exposing others’ data or trade secrets. If only part of a dataset is permissible, we provide that portion and explain omissions.

5) Formats and delivery (Formats & Delivery)

• Formats: CSV for tabular data, JSON for structured data, XML on request, plus optional PDF summaries.
• Encryption and transfer: HTTPS downloads with time-bound, single-use links; SFTP with unique least-privilege credentials revoked after use; AES-256 or PGP on request; checksums for integrity.
• API access: Scoped, short-lived token/endpoint where technically feasible and lawful.
• Cross-border safeguards: Where data is transferred internationally, we indicate the destination countries/recipients and applicable safeguards (e.g., SCCs/BCRs) and can provide information on those safeguards on request.
• Large deliveries: May be split into batches; we coordinate timing.
• Expiry: Default link expiry 7 days; alternatives available with justification. No delivery to unverified or high-risk domains.

6) Timelines and service levels (Timelines & SLA)

• Acknowledgment: We aim to acknowledge requests within 7 calendar days.
• Fulfillment: Target delivery within 30 calendar days after verification unless a shorter legal deadline applies. Under GDPR/UK GDPR we may extend by up to 2 months for complex requests, with notice.
• Enterprise: Order-form SLAs supersede this baseline for covered services.
• Status: Complex requests receive periodic updates and an estimated completion date.
• Delays/fees: Manifestly unfounded or excessive requests may incur lawful fees or extended timelines; we explain before applying a fee.
• Safety pauses: Overlapping rights requests may be paused to reduce security or privacy risk.

7) Security and privacy safeguards (Security & Privacy)

• MFA-based verification and access checks precede any release.
• Data is encrypted in transit (TLS) and at rest (e.g., AES-256) in export systems.
• Audit trails cover export creation, access, download, and delivery.
• We apply minimization/redaction to limit third-party exposure.
• Suspicious requests may be halted pending extra checks or denied with reasons.
• You must secure data after receipt; if a breach occurs during or after delivery, we follow our Incident Response Plan (IRP) and notification rules.
• Temporary credentials follow least privilege and are revoked after completion.

8) Fees, frequency limits, and acceptable use (Limitations)

• No fee for a first reasonable request. Where law allows, repetitive, excessive, or unfounded requests may incur a fee or be declined; we explain any fee or refusal and options.
• Fair-usage limits may space similar requests over time to protect system stability and others’ privacy.
• Access must not be used to obtain intellectual property, trade secrets, or others’ data; misuse may lead to denial, safeguards, or notice to authorities.
• If we narrow a request, we explain the basis and available alternatives.

9) Appeals and escalation channels (Appeals & Oversight)

• Appeal by emailing privacy@tanqory.com within 30 days, citing your request ID and reasons. We aim to review within 15 business days and will inform you if more time is needed.
• If unresolved, you may contact the relevant supervisory authority (EU/UK/SG DPA or applicable U.S. state regulator).
• For arbitration terms with Tanqory Inc., see the preamble and your service agreement.

10) Recordkeeping and audit (Recordkeeping & Audit)

• We log requests, verification steps, approvals/denials, delivery dates, formats, channels, file sizes, and any limits or fees.
• Records are retained for at least 3–5 years or longer if required by law, contract, or litigation hold, with encrypted, role-based access.
• We review the process under our ISMS and, where applicable, SOC 2 controls, and track remediation.
• Material changes to tooling or process are tested and recorded before production use.

11) Policy updates and language (Policy Updates)

• Reviewed at least annually or sooner if laws, platform requirements, audit findings, or security events require changes.
• Significant updates appear at https://legal.tanqory.com and via registered email, noting effective date, version, and change summary.
• The English version is authoritative; translations are for convenience.
• Questions: privacy@tanqory.com.

---

Appendix A: Illustrative data elements we may provide

• Account profile: name, registered email, verified phone number, language, timezone.
• Account/store/domain settings: store name, key configuration values, currency, enabled features.
• Activity and security logs: abbreviated login history, feature toggles, configuration changes, MFA devices, recovery options without exposing secrets.
• Transactions/orders owned by the requester: order IDs, totals, status, timestamps, with third-party personal data redacted.
• API usage and integrations: non-secret API keys, endpoints invoked, timestamps, response codes, integration name, scopes, status.
• Billing summaries: billing dates, amounts, currency, tax summary; no full PAN/CVV or secrets.
• Support interactions: ticket subjects, timestamps, and summaries that relate to the requester.
• Import guidance and checksum values to verify file integrity where relevant.

Appendix B: Common exclusions and limitations

• Information prohibited from disclosure by law, court order, law-enforcement hold, or third-party contractual restrictions (e.g., PCI DSS obligations).
• Intellectual property or trade secrets of Tanqory or its partners, including proprietary algorithms and internal security controls.
• Personal data of other individuals that cannot be separated without infringing their rights (we will redact or summarize instead).
• Full payment card data (PAN), CVV/CVC, secret API keys, encryption keys, or other credentials that could be used to compromise security.
• Records that would unnecessarily reveal identities of reporters, investigators, or security measures beyond what is appropriate to fulfill the request.

---

Glossary

• API (Application Programming Interface): Interface for system-to-system data exchange.
• CSV (Comma-Separated Values): Tabular file format using commas as delimiters.
• JSON (JavaScript Object Notation): Human- and machine-readable data format for structured information.
• MFA (Multi-Factor Authentication): Authentication using two or more factors.
• PAN (Primary Account Number): Full payment card number.
• PGP (Pretty Good Privacy): Encryption standard for securing files or email.
• SFTP (Secure File Transfer Protocol): Encrypted file transfer protocol using SSH.
• IRP (Incident Response Plan): Documented process for handling security incidents.
• ISMS (Information Security Management System): Framework for managing information security risks.
• SOC 2: Audit framework assessing security, availability, confidentiality, processing integrity, and privacy controls for service providers.