10. United Kingdom and European Union Privacy Rights
If you reside in the European Union, you may have certain privacy rights
under Regulation (EU) 2016/679, the General Data Protection Regulation
("GDPR"), to the extent the GDPR does not conflict with the laws of the
United Kingdom. Even if we do not have a legal obligation to do so under
the laws of the United Kingdom, we may respond to your requests made per
the GDPR. However, voluntary responses are not a waiver of our legal
rights and obligations under the laws of the United Kingdom or the
arbitration provisions found within our website’s Terms and Conditions
of Use.
Small or Medium-Sized Enterprise Status
We are a small or medium-sized enterprise (“SME”). This means that
because of the size of our business, to the extent (if any) the GDPR
governs our relationship with you, some of GDPR’s obligations do not
apply because we are an SME.
How to Make A Request
To make a GDPR request, please contact us by using one of the contact
methods listed on our Website’s “Contact” page at www.spectralcore.com/contact-us. We will respond within thirty (30) days of receipt of your request.
Requests to Access Personal Data
If we grant your request to access personal data, we will: (1) confirm
whether or not we are processing your personal data; (2) provide you
with a copy of any of your personal data that we possess; and (3)
provide you with information about how we process such data (e.g.
purposes, categories, recipients, etc.).
Requests to Delete Data
If you request that we delete your personal data that we possess, we
will do so unless: (1) the data is needed to exercise the right of
freedom of expression; (2) we have a legal obligation to keep the data;
(3) we must keep the data for reasons of public interest; or (4) the
data has been processed so that it is anonymized.
Any personal data we processed unlawfully will be deleted. If you were a
minor when we collected the personal data, we will delete the data upon
request.
If we believe any third parties have acquired your personal data through
us, we will take reasonable steps to inform them that you have requested
erasure of such data.
Objections to Processing of Personal Data
If your request is an objection to the processing of your personal data
for directing marketing purposes, we will cease using your data for such
purposes.
As a general rule, we will comply with objections to processing personal
data except: (1) where it is not technically or commercially feasible to
do so; or (2) we have a legal obligation that overrides your individual
rights and freedoms.
Portability Requests
If we collected personal data from you because of a contract between us
or based on your consent, and we processed that data by automated means
(in structured machine-readable format), you can request that data be
transmitted by us to another company or organization.
We will provide such data to the recipient third party in a commonly
used open format electronic file (e.g. CSV, JSON, XML, etc.).
Denied Requests
If we reject your request, we will provide you with the reason(s) for
doing so. You may then choose to file a complaint with the Data
Protection Authority and request a judicial remedy to the extent such a
request is not in conflict with the laws of laws of the United Kingdom
or the arbitration provisions of our website’s Terms and Conditions of
Use).
Processing Fees
As a general rule, there is no fee for processing your GDPR request.
However, we reserve the right to refuse your request or charge a
reasonable fee for processing it if the request is manifestly unfounded
or excessive. For example, it would be excessive to make a repetitive
second request to access your personal data one month after we provided
you with the data from a prior request.
Automated Processing
We may make decisions through automated processing (e.g. algorithms) of
personal data that are legally binding or significantly affect you.
Any such automated decision-making is done per your express consent or
because it is necessary for reasons of substantial public interest under
applicable law.
Such an automated decision may be made based on relevant law. However,
if the decision is made for other reasons, we will inform you of the
process’ logic and potential consequences of the decision. To the extent
that the GDPR does not conflict with the laws of the United Kingdom or
the arbitration provisions found within our website’s Terms and
Conditions of Use, you may also have a right to obtain human
intervention and contest the automated decision.