Data subject requests

Under the GDPR, you can ask us to do several things with the personal data we hold about you. This page explains what you can ask for, how to ask, and what to expect.

1. What you can ask for

• Access - a copy of the personal data we hold about you (Art. 15).
• Rectification - correct inaccurate or incomplete data (Art. 16).
• Erasure - delete your data, subject to legal retention (Art. 17).
• Restriction - pause certain processing (Art. 18).
• Portability - receive your data in a structured machine-readable format (Art. 20).
• Objection - object to processing based on legitimate interest (Art. 21).
• Withdraw consent - where processing is based on consent (Art. 7).

2. How to send a request

Write to contact@ecgtready.eu from the email address linked to your account. Include:

• The right you are exercising.
• Enough detail to find your record (account email, store URL).
• Your preferred response format if you have one.

If you write from a different email we may need additional information to verify your identity, to make sure we are not handing data to the wrong person.

3. How long it takes

• We acknowledge receipt within 5 business days.
• We respond within 30 days from receipt of a complete request.
• For complex or numerous requests we may extend by up to two further months and will tell you why.

4. Cost

Requests are free. We may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act, in line with GDPR Article 12(5).

5. If we decline

We tell you why and we tell you about your right to lodge a complaint with the Commission Nationale pour la Protection des Donnees (CNPD, cnpd.lu) or your local supervisory authority.

6. Internal process

Internally we log every request, verify identity, retrieve and package the data, and document the response. Logs are retained for 24 months for accountability under GDPR Article 5(2).