Regional privacy rights

01How this page works

This page supplements the privacy policy for people in specific regions. It lists the main laws, the rights they give you, and the authority you can complain to. To use any right, follow the privacy choices page or write to [email protected] with the subject “Privacy request” and your country or state.

02European Economic Area, United Kingdom, and Switzerland

The GDPR, the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection apply to our processing of your data. Nubesti is the controller described in the privacy policy, which lists the legal bases for each purpose, the transfer safeguards, and the retention periods.

You have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right not to be subject to decisions based solely on automated processing. We answer within one month, extendable by two months for complex requests. You can complain to the supervisory authority where you live, work, or where an infringement happened. The list of EU authorities is at edpb.europa.eu. In the United Kingdom it is the Information Commissioner’s Office, and in Switzerland the Federal Data Protection and Information Commissioner.

For users of our service in the European Union, the Data Act lets you switch to another provider and export your data, as described in the terms of service.

03United States

This section is our notice at collection and privacy notice for the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and for the comprehensive privacy laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. It applies where those laws apply to Nubesti.

In the last 12 months we collected these categories of personal information:

Sources, purposes, and retention periods are described in the privacy policy. We use sensitive personal information only for the purposes the law permits, such as providing the service, security, and identity verification. We do not knowingly sell or share the personal information of consumers under 16. We do not offer financial incentives for personal information.

Your rights include knowing what we collect and disclose, access, correction, deletion, portability, and opting out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We honor Global Privacy Control as an opt-out. You will not be discriminated against for using these rights. You can use an authorized agent, and you can appeal a refusal as described on the privacy choices page.

California residents can also ask, under the Shine the Light law, whether we disclosed personal information to third parties for their own direct marketing. We do not. Nevada residents can opt out of sales as defined by Nevada law by writing to [email protected], although we do not sell under that definition.

Biometric and consumer health data: identity verification may involve biometric data covered by the laws of Illinois, Texas, Washington, and Colorado, and by the Washington My Health My Data Act and the Nevada consumer health data law. We collect it only with consent, never sell it, and delete it as described on the identity verification page. Children’s data is not collected, as described under the Children’s Online Privacy Protection Act in the privacy policy.

04Canada

We follow the Personal Information Protection and Electronic Documents Act and provincial laws, including Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25. The person in charge of the protection of personal information can be reached at [email protected]. You can access and correct your information, withdraw consent, and ask for your computerized information in a structured, commonly used format. We assess transfers outside Quebec before they happen, and we record and report confidentiality incidents as the law requires. You can complain to the Office of the Privacy Commissioner of Canada or to the Commission d’accès à l’information du Québec.

05Latin America

We respect the data protection laws of Latin America, including habeas data rights recognized in national constitutions. The main laws and authorities are:

Argentina: The AGENCY OF ACCESS TO PUBLIC INFORMATION, in its capacity as Control Body of Law No. 25,326, has the power to hear complaints and claims filed by those whose rights are affected by non-compliance with the rules in force on the protection of personal data.

06Asia-Pacific

If you are in Asia-Pacific, these laws and authorities apply:

In India, you can contact our grievance officer at [email protected], and you can nominate another person to exercise your rights if you die or become unable to. In Australia and New Zealand, you can ask to access and correct your information, and we will tell you how we handled any complaint. inSigner is not directed at mainland China. If the Personal Information Protection Law applies to you, you can use the rights it grants by writing to us.

07Middle East

If you are in the Middle East, these laws and authorities apply:

08Africa

If you are in Africa, these laws and authorities apply:

Under these laws you can generally access, correct, and delete your data, object to processing, including direct marketing, and complain to the authority. We transfer data from these countries under the safeguards described in the privacy policy.