Data Requests

What you can ask for

You can ask GetJewelryPOS to:

• Access: tell you what personal data we hold about you, where it came from, why we use it and who we share it with, and give you a copy.
• Correct: fix data that is wrong or incomplete.
• Delete: erase data we hold about you, unless we must keep it by law.
• Opt out: stop marketing messages, and opt out of any sale or sharing of your data (we do neither) or of targeted advertising.
• Port: receive a copy in a common, machine-readable format, where your law gives this right.
• Restrict or object: ask us to pause or stop a particular use, where your law gives this right.
• Withdraw consent: where we rely on your consent, take it back at any time.

Our Privacy Policy lists what we collect and why. This page explains how to make a request and what happens next.

How to make a request

Use the form on our contact page and select “Data request” as the subject. In the message, tell us:

1. what you want (access, correction, deletion, opt-out, or something else);
2. your name and the email address or phone/WhatsApp number you used with us;
3. your country (and US state, if you are in the United States), so we apply the right rules;
4. for corrections, what is wrong and what it should say.

Please do not send identity documents, card numbers or other sensitive data in the form. If we need more to verify you, we will ask and tell you a safe way to send it.

If you prefer, press the Show email button on the contact page to see our privacy address and write to us there.

Just want to stop marketing? You can also reply “STOP” where offered or use the unsubscribe link in any message. That works straight away, without a formal request.

How we verify you

We must make sure we are giving data to, or deleting data for, the right person. So we:

• match the details in your request against what we hold, usually the email address or phone number you used with us;
• may send a short code or link to that email address or number and ask you to confirm it;
• ask for more only when the request is sensitive, such as a full copy of data, and only what we need.

We use information you give for verification only to verify you, and we delete it when the request is closed.

Authorized agents. Someone can make a request for you, for example under California law. We will ask for your signed permission and may still ask you to confirm your identity with us directly.

If we cannot verify you, we will tell you why and what else would work.

How long we take

We reply as quickly as we can and always within the time your law sets.

Where you live	Our deadline
United States: California (CCPA as amended by the CPRA)	We confirm receipt within 10 business days and respond within 45 days. If we need more time, we can extend once by up to another 45 days, and we will tell you why.
United States: other states with privacy laws	Within 45 days, extendable once by up to 45 days where the state law allows. If we refuse, we explain how to appeal.
European Union / EEA (GDPR)	Within 1 month. For complex or many requests we can extend by up to two more months, and we will tell you within the first month.
United Arab Emirates (PDPL, Federal Decree-Law No. 45 of 2021)	Within the period the law requires, and we will tell you if we need more time and why.
Pakistan	Pakistan does not yet have a single comprehensive data protection law in force. We give the same rights and aim to respond within 30 days.
Anywhere else	We aim to respond within 30 days.

Requests are free. If a request is clearly unfounded or excessive, for example repeated many times, the law may let us charge a reasonable fee or decline, and we will explain why.

When we may say no

We will act on your request unless the law lets or requires us to refuse. For example:

• we must keep invoices and billing records for tax and accounting periods;
• we need certain data to defend or bring a legal claim;
• giving you a copy would reveal another person’s personal data;
• we could not verify your identity.

If we refuse all or part of a request, we will tell you which part and why. Where your law gives a right to appeal or to complain, we will tell you how. In the EU you can complain to your data protection authority; in the UAE, to the UAE Data Office.

If a jewelry store holds your data

Many people who contact us are not our customers. They are customers of a jewelry store that uses GetJewelryPOS: you bought a ring, left a watch for repair, or have a layaway plan, and the store has your name and phone number in its system.

For that data, the store is in charge (the controller) and we only host it for them (the processor). So:

1. Please contact the store first. It can look up your record, correct it, send you a copy or delete it, using tools in the software.
2. If you cannot reach the store, or it does not respond, use our contact form and select “Data request”. Tell us the store’s name and location. We will pass your request to the store and help it respond.
3. We cannot change or delete a store’s records ourselves without its instruction, because the store may need them, for example for warranty, repair history or tax records. We will tell you if we have passed your request on.

For merchants

If you run a store on GetJewelryPOS and one of your customers makes a request, you can find, export, edit and delete customer records in the app. If you need help, contact our support team through the contact page and we will assist.

Keeping a record

We keep a short record of each request, what we did and when, for 24 months, so we can show we handled it properly. This record does not contain any copy of your data that we sent you.