Data Rectification Request Policy

Short description: This policy explains how to request correction of inaccurate or incomplete personal data held by Tanqory. It covers scope, channels, verification, evidence, what we will correct, timelines, security, limitations, and appeal rights, aligned with GDPR/UK GDPR (Art. 16), Singapore PDPA, and applicable U.S. state privacy laws (e.g., CPRA/CCPA).

1) Purpose and scope (Purpose & Scope)

This policy describes how Tanqory processes requests to rectify inaccurate or incomplete personal data. It applies to data you provided, data observed from your use of our services, and derived data where correction is legally permitted. We align with GDPR/UK GDPR Art. 16, Singapore PDPA rectification provisions, and U.S. state laws that provide correction rights (e.g., CPRA/CCPA). The policy applies to verified users and duly authorized agents. The English version is authoritative; if translations conflict, this text controls. We update the policy when laws or platform requirements change and use plain definitions for acronyms such as MFA (Multi-Factor Authentication), CSV (Comma-Separated Values), JSON (JavaScript Object Notation), and API (Application Programming Interface).

2) Rights and guiding principles (Rights & Principles)

• Right to rectification: You may request correction of inaccurate or incomplete personal data about you. You may also request that we flag disputed data as “under challenge” while verification is pending.
• Notification of recipients: Where feasible and not disproportionate, we will inform relevant processors/recipients of the correction or dispute flag (GDPR/UK GDPR Art. 19).
• Accuracy and minimization: We aim to ensure data is accurate, relevant, and limited to what is necessary. We use redaction or summaries when full correction would expose others’ data or confidential information.
• Fair use: Requests must be reasonable. Manifestly unfounded, excessive, or repetitive requests may be narrowed, delayed, or charged where law permits; we provide reasons.
• No misuse: Correction cannot be used to falsify transaction histories, evade compliance, or misrepresent identity.
• Non-discrimination: We do not penalize you for exercising correction rights, subject to lawful exceptions.

3) How to submit and how we verify (Channels & Verification)

• Where to submit: Data Rights Portal (dashboard), email to privacy@tanqory.com with subject “Data Rectification Request,” or in-app/support forms routed to the same workflow.
• What to include: The sign-up email/account identifier, the data to correct, the proposed correction, relevant date range, and any supporting evidence.
• Identity verification: MFA plus checks against registered email/phone. High-risk changes may require additional proof (e.g., government ID, domain ownership proof) to prevent unauthorized alteration.
• Authorized agents: Must provide (a) valid power of attorney or signed authorization, (b) identification for the account holder, and (c) identification for the agent. Incomplete/mismatched documents pause or deny the request with reasons.
• Status communications: Sent only to verified channels. We maintain audit trails for intake, verification, decisions, and applied corrections.
• Dispute flags and temporary restriction: You may ask us to mark specific data as disputed and, where required by law (e.g., GDPR/UK GDPR Art. 18), to temporarily restrict non-essential processing of that data while verification is underway.

4) Rectification scope and exclusions (Rectification Scope & Exclusions)

Typical items we correct:

• Account profile (name, registered email, verified phone, language/timezone).
• Account/workspace/store/domain settings; business contact details; billing contact details.
• Support/contact records that relate to you.
• Security settings that do not expose secrets (e.g., updating registered devices where properly verified; updating recovery options without exposing others’ data).
• Marketing preferences and identifiers that relate to you.
• Configuration metadata you created (e.g., integration names, labels, non-secret keys) where correction does not expose secrets.

When we redact, flag, or decline:

• Transaction, accounting, and tax records that must remain unchanged for legal compliance; we may add clarifying notes rather than alter records.
• Fraud/security evidence used to establish, exercise, or defend legal claims or prevent abuse; we may annotate but not overwrite.
• Third-party personal data that cannot be altered without infringing their rights; we may redact or separate your data from theirs.
• Proprietary/confidential information (e.g., internal security controls, algorithms); we minimize user-linked elements rather than expose or alter sensitive details.
• System logs: we may append a dispute flag or correction note rather than rewrite historical logs to preserve forensic integrity.

Dispute flagging: If accuracy is contested and verification is pending, we can mark the data as disputed and limit processing where required by law.

5) Evidence requirements (Evidence Requirements)

We may request reasonable evidence to support corrections, such as: government ID or passport (for name/phone/email changes), proof of domain or store ownership (DNS/WHOIS or registration), contracts or bills for business contact changes, or technical artifacts (logs/headers) for API/integration corrections. Evidence must be provided through approved secure channels (encrypted upload/PGP/SFTP). If evidence is insufficient, we will ask for more or deny with reasons.

6) Formats and delivery of results (Formats & Delivery)

• Confirmation: We confirm corrections via verified email, listing what was corrected, annotated, or flagged as disputed.
• Recipient notice: Where feasible and not disproportionate, we notify relevant processors/recipients and can share recipient categories on request (Art. 19).
• Summary of changes: We may provide a short PDF/text summary. Audit trails record who changed what and when.
• No disclosure of secrets: We do not reveal confidential information, trade secrets, or other individuals’ data in our confirmations.

7) Timelines and service levels (Timelines & SLA)

• Acknowledgment: We aim to acknowledge within 7 calendar days.
• Fulfillment (GDPR/UK GDPR): Target completion within 30 calendar days after verification; may extend by up to 2 months for complex cases with notice and reasons.
• U.S. state laws (e.g., CPRA/CCPA): For in-scope U.S. requests, target completion within 45 days; may extend once by up to 45 days where reasonably necessary, with notice.
• Enterprise contracts: Order-form SLAs supersede this baseline for covered services.
• Status updates: Provided for complex requests or when awaiting evidence.
• Fees/denials: Manifestly unfounded, excessive, or repetitive requests may incur lawful fees or be denied; reasons are provided.

8) Security and third-party protection (Security & Third-Party Protection)

• MFA-based verification and RBAC controls precede any correction.
• Evidence and communications use encrypted channels (TLS in transit; AES-256 at rest in our systems).
• Audit trails capture request, verification, decision, and the specific fields corrected or flagged.
• Suspicious requests (phishing, impersonation, anomalous patterns) may be paused or denied with reasons.
• We avoid exposing other individuals’ data; redaction or separation is applied where needed.
• Processors/recipients are instructed to align corrections or flags where applicable and feasible.

9) Appeals and limitations (Appeals & Limitations)

• Appeals: Email privacy@tanqory.com within 30 days citing your request ID and reasons. We target review within 15 business days and will inform you if more time is needed.
• If limited: When law, third-party rights, or confidentiality prevent correction, we explain the basis and may offer alternatives (dispute flag, annotation, summary).
• Regulator escalation: You may contact the relevant supervisory authority (EU/UK/SG DPA or applicable U.S. state regulator) if unresolved; contact details available on request.

10) Recordkeeping and audit (Recordkeeping & Audit)

• We log requests, evidence received, verification steps, approvals/denials, corrections made, dispute flags, recipient notifications, and reasons for any limitations.
• Records are retained for at least 3–5 years or longer if required by law, contract, or litigation hold, with role-based, encrypted access.
• We review this process under our ISMS and, where applicable, SOC 2 controls, and track remediation actions.
• Changes to tools or workflows are tested and documented before production use.

11) Policy updates and language (Policy Updates)

• Reviewed at least annually, or sooner if laws, platform requirements, audits, or security events require changes.
• Significant updates are posted at https://legal.tanqory.com and via registered email; we note the effective date, version, and a summary of changes.
• The English version is authoritative; translations are for convenience.
• Questions: privacy@tanqory.com.

---

Appendix A: Examples of data we may correct, redact, or exclude

• Correct: account profile (name/email/verified phone), language/timezone, account/store/domain settings, business contact data, non-secret MFA device labels, security settings that do not reveal others, marketing preferences.
• Redact/summarize: records with mixed third-party data (e.g., shared support threads), activity logs exposing others’ IP/device data.
• Exclude: transaction/accounting/tax records required by law; fraud/security evidence; trade secrets/confidential business information of Tanqory/partners.

Appendix B: Typical supporting evidence

• Government ID/passport (for name/contact changes).
• Proof of domain/store ownership (DNS/WHOIS or registration documents).
• Contracts or business bills showing correct contact/address.
• Technical evidence (logs/headers) for API/integration corrections.
• Power of attorney (POA) and ID for the account holder and agent.

Appendix C: Additional requirements (U.S. states and new laws)

• For U.S. state laws that grant correction rights (e.g., CPRA, CPA), Tanqory will follow any format or notification requirements and include relevant URLs for opt-out/Do Not Sell/Share and Global Privacy Control (GPC) signals where applicable.
• New state/country laws with specific correction rules will be added to this appendix and announced via dashboard/registered email.
• Enterprise SLAs follow the Order Form/contract addenda; references or URLs can be listed here for clarity when required by the contract.
• Upon request for audit purposes, we can map controls to relevant standards (e.g., GDPR Art. 16, Singapore PDPA rights, SOC 2 criteria) where appropriate.

---

Glossary

• API (Application Programming Interface): Interface enabling programmatic system-to-system data exchange.
• MFA (Multi-Factor Authentication): Authentication using two or more factors.
• POA (Power of Attorney): Authorization for an agent to act on behalf of the account holder.
• PGP (Pretty Good Privacy): Encryption standard for securing files/email.
• SFTP (Secure File Transfer Protocol): Encrypted file transfer protocol using SSH.
• ISMS (Information Security Management System): Framework for managing information security risks.
• SOC 2: Audit framework covering security, availability, confidentiality, processing integrity, and privacy controls.
• RBAC (Role-Based Access Control): Authorization model that assigns permissions by role.
• DPA (Data Protection Authority): Supervisory authority overseeing data protection laws.