GDPR & data subject rights

This page explains the rights you have over the personal data Farshore Labs holds about you and how to exercise them. It applies to individuals in the European Economic Area (EEA), the United Kingdom, Switzerland, and (for the equivalent rights) California and other US states with comprehensive consumer-privacy statutes. For the full description of what we collect and why, see the Privacy Notice.

For account, billing, security, and platform-operations data, Farshore acts as the data controller. When you submit input to a service (e.g. a name to screen against a sanctions list), Farshore acts as a data processor on your behalf. Customers who require a written Data Processing Agreement (DPA) can request the standard Farshore DPA from privacy@farshorelabs.com. The DPA incorporates the European Commission’s Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum where relevant.

• Right of access (Art. 15): obtain a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Art. 16): correct inaccurate or incomplete personal data. Most account fields can be edited from the account dashboard.
• Right to erasure (“right to be forgotten”, Art. 17): request deletion of your account and associated personal data, subject to limited exceptions (e.g. tax records).
• Right to restriction (Art. 18): pause processing while a dispute about accuracy or lawful basis is resolved.
• Right to data portability (Art. 20): receive your account and subscription data in a structured, machine-readable format (JSON).
• Right to object (Art. 21): object to processing that we base on legitimate interests.
• Rights regarding automated decision-making (Art. 22): Farshore does not make decisions that produce legal or similarly significant effects about you using purely automated means.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint with your local supervisory authority. The EDPB maintains a current list of authorities.

The fastest path is to sign in and use the controls in your account dashboard. To submit a formal Data Subject Request (DSR), email privacy@farshorelabs.com from the address on your Farshore account and include:

• The right you wish to exercise.
• Enough information to identify the account (email, account ID, or the prefix of an active API key).
• For erasure requests: an explicit confirmation that you want the account closed.

We will acknowledge receipt within five (5) business days and respond within thirty (30) days. Where a request is complex, we may extend by up to two further months and will tell you why. We do not charge for DSRs unless they are manifestly unfounded or excessive.

If you submitted a request to a Farshore customer (the controller) and we are the processor, we will refer you back to that customer and assist them in fulfilling your request.

If you are a resident of California, you have the rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information under the CCPA/CPRA. We do not sell or share personal information for cross-context behavioural advertising, so there is no global opt-out signal to honour for that purpose. Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comparable laws have equivalent rights.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify you without undue delay, and in any event within 72 hours of becoming aware, where required by law. We maintain an internal incident response runbook that covers containment, forensics, regulator notification, and customer communication.

Farshore maintains a Record of Processing Activities (RoPA) per Article 30 GDPR and conducts Data Protection Impact Assessments (DPIAs) for new high-risk processing. A summary of the RoPA for each service can be requested by an active customer.

Primary contact: privacy@farshorelabs.com.