Data Processing Choices

1. Your rights at a glance

• Access — request a copy of the personal data we hold about you.
• Portability — receive certain data in a structured, machine-readable format.
• Correction — fix data that is inaccurate or incomplete.
• Deletion — ask us to delete personal data we no longer need.
• Restriction — ask us to pause certain processing while we investigate a concern.
• Objection — object to processing based on legitimate interests, including marketing.
• Withdraw consent — for any processing based on your consent. Withdrawal does not affect lawfulness of prior processing.
• Opt-out (California / CCPA) — opt out of any “sale” or “sharing” of personal data. For clarity: we do not sell or share personal data for cross-context behavioural advertising.
• Non-discrimination — we will not treat you worse for exercising any of these rights.

2. How to make a request

1. Email support@capitalfortress.org from the email address linked to your account. Use the subject line Data request — [Access | Correction | Deletion | Portability | Other].
2. Tell us, in your own words, what you would like us to do. If your request concerns specific data — for example, a particular budget upload — please describe it so we can locate it quickly.
3. If the request comes from someone other than the account holder (for example, an authorised agent), we will need a signed authorisation from the account holder before we can act.

3. Verifying identity

To protect your data we may need to verify that the request really comes from you. Sending the request from the email on the account, replying to a verification email, or confirming the request after signing in will normally be enough. For unusually sensitive requests we may ask for additional confirmation.

4. Response times

• EEA / UK (GDPR): we respond within one month. We may extend by up to two further months for complex or numerous requests; we’ll tell you why if we need the extension.
• California (CCPA): we confirm receipt within ten business days and respond on the merits within 45 calendar days (extendable by another 45 days where allowed).
• Other jurisdictions: we apply the equivalent statutory timeframe where one exists; otherwise we aim for one month.

5. When we may decline

We may decline a request — and explain why — when complying would undermine the rights of others, violate a legal obligation, or break what the law requires us to keep. Examples: deleting an active billing record before the statutory retention period ends; sharing investigation notes that would compromise an ongoing fraud review; responding to manifestly unfounded or excessive repeat requests.

6. Authorised agents

California residents may use an authorised agent. We will need a signed authorisation from you confirming the agent’s mandate and the scope of the request. We may still ask you, the account holder, to confirm the request directly.

7. Complaints

If you are not satisfied with our response you can complain to your local data-protection authority. For Romania, the supervisory authority is ANSPDCP (dataprotection.ro). For the UK, the ICO. For California, the California Privacy Protection Agency. Other jurisdictions have analogous bodies.

8. Marketing and email preferences

• To stop transactional emails (account, billing, security): you cannot opt out of transactional emails while keeping the account; if you do not want to receive them, close the account from the Danger Zone on your account page.
• To stop optional product-update or educational emails: click the unsubscribe link in any such email, or write to support@capitalfortress.org.

9. Children

The Service is not directed to children under 18. We do not knowingly process personal data of children. If you believe a child has registered, write to support@capitalfortress.org and we will delete the account.