Your Data Rights
Last updated: 2026
Your privacy rights depend on where you live. This page summarises them and explains how to exercise them. To make a request, email privacy@thecefa.org or use your in-app account settings. We verify your identity before acting, respond free of charge within the timeframe the law requires (one month under the GDPR; 45 days under US state laws, extendable where permitted), and you may use an authorised agent.
EU / EEA / UK (GDPR and UK GDPR): you have the right to access your data; to rectify inaccurate data; to erasure ("right to be forgotten"); to restrict or object to processing, including profiling; to data portability; and to withdraw consent at any time without affecting prior processing. You are not subject to solely automated decisions with legal or similarly significant effects without safeguards. You may lodge a complaint with your national data-protection supervisory authority.
California (CCPA/CPRA): you have the right to know and access the personal information we collect and how we use it; to delete it; to correct it; to opt out of sale or sharing (we do not sell or share personal information); to limit use of sensitive personal information; and to be free from discrimination for exercising these rights. We honour Global Privacy Control (GPC) signals.
Other US states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana): you generally have rights to access, correct, delete, and obtain a portable copy of your data, to opt out of targeted advertising, sale, and certain profiling, and to appeal a declined request.
Other countries: comparable rights apply under laws such as Brazil's LGPD, Canada's PIPEDA, Switzerland's FADP, and similar frameworks; contact us and we will honour the rights available to you.
We do not sell your personal data. If you are unsatisfied with our response, you may escalate to your local supervisory or data-protection authority. Contact: privacy@thecefa.org.