Data Subject Rights (DSAR) Policy

1. Purpose

Incedo Inc. (“Incedo”, “we”, “us”, or “our”) respects your privacy and is committed to enabling individuals to exercise their rights over their personal data.

This Data Subject Rights (DSAR) Policy explains:

• What rights you may have depending on your location.
• How to submit a request to exercise those rights.
• How Incedo will respond to such requests.

2. Who Does This Apply To?

This Policy applies to all individuals whose personal data is processed by Incedo, including:

• Website visitors
• Clients and prospective clients
• Employees and contractors (where applicable)
• Vendors, partners, and business contacts

Your specific rights depend on the privacy laws of your jurisdiction (e.g., GDPR in the EU/UK, CPRA in California, DPDPA in India).

3. Your Data Rights

Depending on your jurisdiction, you may have some or all of the following rights:

(a) Right of Access

• Request confirmation whether we process your personal data.
• Obtain a copy of your personal data in a structured, commonly used format.

(b) Right to Rectification

• Correct inaccurate or incomplete personal data.

(c) Right to Erasure (“Right to be Forgotten”)

• Request deletion of your personal data where legally permissible.

(d) Right to Restrict Processing

• Request that we limit processing of your data under certain circumstances (e.g., dispute over accuracy).

(e) Right to Object

• Object to processing of your data for legitimate interests, direct marketing, or profiling.

(f) Right to Data Portability

• Receive your personal data in a machine-readable format and request transfer to another controller (where technically feasible).

(g) Right to Withdraw Consent

• Where processing is based on your consent, you may withdraw consent at any time.

(h) Rights Under U.S. and State Laws

• California Residents (CCPA/CPRA): Right to know what data we collect, right to delete, right to correct, right to opt out of “sale or sharing” of personal data, and right not to be discriminated against for exercising rights.

(i) Rights Under India DPDPA 2023

• Right to access, correction, erasure, grievance redressal, and nomination of another individual to exercise rights in case of incapacity or death.

4. How to Submit a Request

You may exercise your rights by contacting us through:

📧 privacy@incedoinc.com
📬 Incedo Inc. – Privacy Office
100 Campus Drive, Suite 420
Florham Park, New Jersey 07932, USA

Please include:

• Your full name and contact details.
• A clear description of the right(s) you wish to exercise.
• Any additional information to help us verify your identity.

5. Identity Verification

To protect your data, we must verify your identity before processing your request. Verification may include:

• Matching information we already hold (e.g., email, phone, account ID).
• Requesting additional identification documents (government-issued ID).
• For California residents: requests may also be submitted by an authorized agent with proof of authorization.

6. Response Time

• We aim to respond within 30 days of receiving your request.
• If additional time is needed (e.g., complex requests), we may extend by up to 60 days, and we will notify you of the reason for the delay.
• Under CCPA/CPRA, responses are typically required within 45 days (extendable once by an additional 45 days).

7. Fees

We will not charge a fee for processing most requests. However, if a request is manifestly unfounded, repetitive, or excessive, we may:

• Charge a reasonable fee to cover administrative costs, or
• Refuse to act on the request (with justification).

8. Limitations to Rights

Your rights are subject to certain limitations:

• We may retain data where necessary to comply with legal obligations (e.g., tax, regulatory, audit).
• We may deny deletion requests if retaining data is necessary to complete transactions, detect fraud, or enforce agreements.
• Some laws (e.g., CCPA) allow exceptions for business purposes.

9. Appeals and Complaints

• If you are dissatisfied with our response, you may escalate by contacting privacy@incedoinc.com with “Appeal” in the subject line.
• EU/UK residents: You may lodge a complaint with your supervisory authority.
• California residents: You may contact the California Privacy Protection Agency (CPPA).
• India residents: You may file a grievance with the Data Protection Board of India.

10. Changes to This Policy

We may update this DSAR Policy from time to time to reflect changes in law or practice. Updates will be posted on this page with a revised “Last Updated” date.

11. Governing Law

This Policy shall be governed by and construed in accordance with the laws of the State of New Jersey, United States, without regard to conflict of law principles.

Any disputes shall be subject to the exclusive jurisdiction of the state and federal courts located in New Jersey, USA.