Effective 1 September 2026
GDPR and California privacy-rights matrix
This operational matrix maps GDPR rights to California CCPA/CPRA rights and the controls ResearchBuddy provides.
Rights matrix
| Right | European basis | California basis | ResearchBuddy response |
|---|---|---|---|
| Transparent notice | GDPR Arts. 12 to 14 | Notice at collection / privacy policy | See categories, sources, purposes, recipients, retention, transfers and rights before or when data is collected. |
| Know and access | GDPR Art. 15 | Right to know | Confirm processing and receive eligible personal data plus category, source, purpose and recipient information. |
| Correct | GDPR Art. 16 | Right to correct | Correct inaccurate account, profile and attributable contribution data. |
| Delete | GDPR Art. 17 | Right to delete | Delete eligible data, subject to security, legal, payment, shared-record and research-integrity exceptions. |
| Portability | GDPR Art. 20 | Portable access format | Receive provided data in structured, commonly used formats where applicable. |
| Restrict processing | GDPR Art. 18 | Limit sensitive use | Restrict eligible processing or limit sensitive-personal-information uses if such a use begins. |
| Object | GDPR Art. 21 | Opt out of sale/sharing | Object to legitimate-interest processing. We do not sell data or share it for cross-context behavioral advertising. |
| Withdraw consent | GDPR Art. 7(3) | Consent withdrawal | Withdraw optional analytics through Cookie choices as easily as granting it. |
| Automated decisions | GDPR Art. 22 | Access/opt out/appeal ADMT where applicable | ResearchBuddy does not make solely automated legally significant decisions; request human review of any disputed automated effect. |
| Non-discrimination | GDPR fairness principle | Right to non-discrimination | Receive equal service and pricing when exercising privacy rights, except a difference reasonably related to the data required for a feature. |
| Complain or appeal | Supervisory authority and judicial remedy | Appeal and Attorney General/CPPA channels | Appeal a denial and contact IMY, your local supervisory authority, or the competent California authority. |
Self-service controls
- Download an account ZIP from Settings.
- Export complete project archives, including source files and the Research Ledger, from each authorized project.
- Request verified account deletion from Settings.
- Change or withdraw optional analytics through Cookie choices in every footer.
- Use the form below for access, correction, deletion, portability, restriction, objection, sale/share opt-out, sensitive-use limitation, automated-decision review or appeal.
Profile, CV, community, and communication controls
- Edit or hide the public profile and individual optional profile fields.
- Keep an uploaded CV private, remove it, or deliberately enable a public CV link.
- Choose post visibility before publishing and use deletion or moderation requests for eligible contributions.
- Follow or unfollow, accept or decline Collaborator requests, and block or mute another account.
- Configure immediate, unread-only, daily, weekly or disabled email categories and use unsubscribe controls in eligible messages.
- Hide a daily suggestion or ask to see fewer recommendations on that topic.
- Review why a feed item was recommended and reset behavioral recommendation history from Community filters.
- Edit or close an expert-services profile, control availability, and request access to engagement, conflict, review, payout-status, and marketplace transaction records that are eligible for disclosure.
- Request a different public profile address, see a pending request, and challenge an address decision. Active and pending addresses are protected against duplicate assignment.
- Close your open review calls, withdraw eligible applications, and access the disclosure level and human or human-assisted review mode recorded for your engagements.
- Access publication pathways, contributor and AI-use records, submission packages, institutional enrollments, and associated progress information through account or project exports where available.
Submit a verified request
We verify identity and authority before disclosing or deleting data. Authorized agents may be asked for signed permission. A request is not used to discriminate against you.
Response timing
For GDPR requests, we respond without undue delay and normally within one month; a complex or numerous request can be extended by up to two further months with notice. For California requests to know, access, correct, delete or appeal an automated decision, we confirm receipt within 10 business days and respond within 45 calendar days; a justified extension can bring the total to 90 days. Sale/share opt-outs and sensitive-use limitations are honored as soon as feasible and no later than 15 business days where that California deadline applies.
Scope and exceptions
Sansa Group AB honors the controls described here even where a particular statute does not apply because of jurisdiction or business-size thresholds. Rights remain subject to lawful exceptions, the rights of collaborators, research-integrity records, fraud/security needs, payment and tax obligations, and records required to establish or defend legal claims. Any denial will identify the reason and available appeal route.