Your privacy rights (GDPR)

Under the EU General Data Protection Regulation (GDPR) and UK GDPR, you have specific rights over the personal data we hold about you. As an invited Client Portal user, you exercise the rights over your own portal identity and activity from My Privacy Rights in the portal. This page explains what’s there and how to use it.

What you can do from My Privacy Rights

Right	What it means	How to exercise
Access (Art. 15)	Receive a copy of all personal data we hold about you, as a downloadable ZIP.	My Privacy Rights → Submit request under Right of access. Ready within one calendar month, usually within a few hours — we e-mail you when it is. The export itself is not e-mailed: download it from My recent requests → Download. Each click opens a fresh link that works for one hour, and the export is kept for 7 days, after which you’d submit a new request.
Rectification (Art. 16)	Correct inaccurate personal data.	Submit a Rectification request saying what is wrong, and an operator reviews it. The portal has no profile page where you could edit your details yourself.
Erasure (“right to be forgotten”, Art. 17)	Permanently delete your Client Portal profile and activity — your name, e-mail, sign-in history, and the support cases filed under your e-mail address. Records of the consents you gave are kept for six years as evidence of what was agreed. This does not delete your organisation’s productions or brand assets — those belong to the organisation that invited you.	Request erasure, tick the confirmation, and confirm. It takes effect 30 days after you submit it. To cancel during that window, contact support — the portal has no cancel button yet, although its confirmation dialog says you can cancel from the page.
Portability (Art. 20)	Receive your personal Client Portal data in a machine-readable format.	Same request and download path as the right of access.
Automated decision-making (Art. 22)	Right not to be subject to a decision based solely on automated processing.	JARAI’s AI pipeline makes decisions about your organisation’s productions, not about you personally as a portal user — submitting this request confirms that and tells you how to ask about a specific production.
Lodge a complaint	If you believe your data hasn’t been handled correctly.	My Privacy Rights links directly to the ICO’s complaint page, or use your own local supervisory authority below.

Tracking a request

Every request you submit shows a confirmation with its own ID, and appears under My recent requests on the same page with its status (In progress, Partial, 30-day grace, Completed, Cancelled, Rejected or Failed), when you submitted it, its due date (the SLA column), when it completed, and — for access and portability — a Download button once the export is ready.

Response times

Acknowledgement: automatic on submission
Resolution: we aim to respond within one calendar month — usually within a few hours for access, portability and erasure
Erasure: carried out 30 days after you submit it; until then you can ask support to cancel it

Complaints

If you believe we’ve handled your data wrong, you can:

Email us at privacy@jarai.studio — we’ll respond within one calendar month
Lodge a complaint with your supervisory authority — see below

You can complain to the data protection authority for the country you live in. Every jurisdiction with data protection law designates one, and you may approach yours directly — you do not have to come through us first.

To find yours:

In the EEA — the European Data Protection Board publishes a directory of every national authority.
In the UK — the Information Commissioner's Office (ICO).
Anywhere else — search for your country's data protection authority, privacy commissioner or information commissioner. Most publish an online complaints form.