Your privacy rights.

United Kingdom

UK data-protection law provides rights to information, access, correction, erasure, restriction and, in specified circumstances, portability and objection. Consent can be withdrawn where processing relies on it, without changing the lawfulness of earlier processing. Rights and exemptions depend on the processing involved.

Rights requests generally require a response without undue delay and within one month, subject to lawful clarification, verification and extension rules. The current UK complaint-handling rules also require an organisation to facilitate privacy complaints, acknowledge them within 30 days and investigate and respond without undue delay. BOTH’s working complaint channel remains to be established.

You may complain to the Information Commissioner’s Office (ICO). See the ICO’s information about individual rights.

EU, EEA and Switzerland

Where EU GDPR applies, rights include access, correction, erasure, restriction, portability and objection, subject to their conditions. You can withdraw consent where it is the basis used. You may complain to the supervisory authority in the member state of your habitual residence, place of work or an alleged infringement.

EU GDPR normally requires action on a rights request within one month; an extension of up to two further months may be available where necessary given the complexity or number of requests, with reasons communicated within the first month. The UK’s specific complaint-acknowledgement rule is not an EU-wide deadline.

Find your authority through the European Data Protection Board’s member list. The EU/EEA representative assessment and any required representative contact for BOTH remain incomplete; no representative has been identified in this notice.

Swiss law separately provides information and access rights, correction and other remedies, with portability in defined circumstances. Swiss rights should not be assumed identical to EU GDPR. See the Federal Data Protection and Information Commissioner (FDPIC) for guidance and reporting information.

United States

US privacy rights vary by state and by whether a particular law covers the business and processing. Some laws have revenue or volume thresholds; others do not. A small or prelaunch business is not automatically outside all privacy laws.

Where applicable, state rights can include knowing or accessing information, correction, deletion, a portable copy, opting out of sale, targeted advertising or certain profiling, and limits or consent requirements for sensitive information. Some states provide an appeal when a rights request is refused and allow authorised agents. Exercising applicable rights must not result in unlawful discrimination.

California’s CCPA/CPRA rights apply only when its coverage requirements are met. They include rights to know, delete and correct, and to opt out of sale or sharing. Technical information used for hosting and security is described in our main privacy notice; no sale, advertising-sharing or targeted-advertising feature is configured on this preview.

For privacy signals and cross-site tracking, see your choices. This site does not offer an account, so it has no account-data settings or account-deletion interface. An operator rights/appeal channel still needs to be provided.

For California information, see the California Attorney General’s CCPA guide. Other state privacy authorities and attorneys general provide the routes applicable in their jurisdictions. Deceptive privacy practices can also be reported through the Federal Trade Commission.

India

India’s Digital Personal Data Protection Act and rules have phased commencement. The core notice, consent, fiduciary-duty and individual-rights provisions are scheduled to take effect on 13 May 2027. They are not described here as already operative on the date of this notice. Existing information-technology and cybersecurity rules require separate assessment.

Before an applicable Indian launch or the relevant commencement, the notice and processes will need to cover purposes, applicable consent, access information, correction and erasure, grievance handling and other statutory requirements. UK legitimate interests are not a substitute for the Indian processing grounds.

[To be added: applicable Indian grievance contact and completed local notice]

Official sources: MeitY commencement notification (PDF) and DPDP rules and updates.

Singapore

Where Singapore’s PDPA applies, individuals can request access to personal data and information about its use or disclosure, request correction, and withdraw consent with reasonable notice, subject to the Act’s conditions and exceptions. Withdrawal can affect a service where the information is necessary to provide it.

The applicable organisation must designate a responsible data-protection officer and make the relevant business contact available. BOTH has not yet supplied that contact. The website does not currently collect telephone numbers or run a marketing-email signup.

[To be added: responsible DPO’s public business contact]

See the Personal Data Protection Commission’s explanation of obligations and its data-protection concern route.

Japan

Where Japan’s APPI applies, rights concerning retained personal data can include disclosure, correction and, under specified conditions, stopping use, erasure or stopping third-party provision. The circumstances and exceptions differ from EU GDPR.

The responsible operator, purposes, request procedures, relevant security information and overseas-transfer arrangements need to be made available as required. BOTH’s operator details and final Japanese-language notice remain incomplete. The July 2026 APPI amendment has staged future commencement; its new provisions are not all treated as current duties in this notice.

See the Personal Information Protection Commission’s legal information, contact information and 2026 amendment updates.

South Korea

Where South Korea’s PIPA applies, rights include access, correction or deletion, and requesting suspension of processing, subject to statutory conditions. Separate rules address sensitive information, overseas transfers and certain fully automated decisions. The amendments effective 11 September 2026 must also be considered.

A complete Korean notice needs the actual data categories, purposes, retention, destruction process, rights procedures, responsible privacy contact and relevant outsourcing and overseas-transfer details. A generic statement about global hosting does not complete those disclosures.

[To be added: Korean-language notice; CPO contact; overseas recipients and contacts, countries, categories, timing/method, purposes, retention, legal route and applicable refusal consequences; domestic agent if required]

For independent help, see the PIPC’s information about reporting a personal-information infringement. Its September 2026 law update explains the latest changes.