Data Rights and Requests

For an Onlyform account, billing record or interaction with Only (Pvt Ltd), use the privacy contact on Company and contact. For answers to a customer's form, contact that form's owner first: it decides why the answers are collected and ordinarily directs us as its processor. If you cannot identify the owner, provide the form URL so we can assist without disclosing another customer's confidential information.

Tell us what you want to do: access or copy information, correct it, delete it, restrict a use, object, withdraw consent, obtain a portable copy, appeal a decision or raise a complaint. Include the account email or form URL, approximate date and enough context to locate the record. State your country if you want us to assess regional rights. You do not need to quote legislation.

Do not include a password, full payment details, identity document, wallet private key or unrelated sensitive information. We will request any additional verification through an appropriate channel if necessary. We use verification information for that purpose and protect other people's information when responding.

Available product controls can help you export results or amend account details. For requests not supported by those controls, use the privacy contact. We do not claim that a complete self-service account export or erasure flow exists in every version of the dashboard.

Cancelling billing, moving a form to trash, permanently deleting a form and closing an account are distinct. Ask for the intended scope explicitly. We explain records retained for a legal obligation, a dispute or a lawful exemption and any relevant backup handling. We cannot remove a customer's already-exported copy, another provider's independent records, or public blockchain entries, but will explain the responsible recipient where possible.

Indian privacy requirements apply according to their scope and commencement dates. The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement; this notice does not suggest every provision was already effective on the draft date. Where the relevant rights are in force and applicable, you may seek information about processing, correction or erasure, grievance redressal, and nomination of another individual in the circumstances allowed by law.

We will direct a complaint to the designated grievance contact once the company particulars are finalised. Any requirement to first seek redress from the Data Fiduciary before approaching the Data Protection Board applies as provided by the law then in force. Existing applicable information-technology, consumer and other legal remedies are not displaced by this notice.

Subject to applicable conditions, rights include access, correction, erasure, restriction, portability and objection. You may withdraw consent without affecting the lawfulness of processing before withdrawal. You may object to direct marketing, and to legitimate-interest processing on grounds relating to your situation. Rights relating to qualifying automated decisions also apply where relevant.

EU/UK requests generally require a response within one month, with a lawful extension for complex or numerous requests and timely notice of the extension. You may complain to your competent supervisory authority. Swiss rights and procedures apply under Swiss law rather than automatically adopting every EU deadline. If a representative or data-protection officer is legally required, the company must publish the appointment details; this draft does not invent an appointment.

Where a state privacy law applies to our business and your information, you may have access/knowledge, correction, deletion, portability and opt-out rights for sale, targeted advertising or certain profiling. Sensitive-data consent or limitation rights may also apply. We assess authorised-agent requests and appeals as required. We do not retaliate against a valid rights request.

For California requests subject to the CCPA, response periods and verification requirements follow that law, including generally 45 days for qualifying access, correction and deletion requests with a permitted extension and notice. Other state deadlines and exemptions differ. Worldwide access to the service alone does not make every jurisdiction's law apply to every account.

If you are elsewhere, tell us the right or concern and we will assess the local requirements, including applicable complaint and appeal routes. These examples do not reduce a right available under another country's law.

We explain the result, any lawful refusal or redaction, and the available appeal or regulator route. Most requests are free; a charge or refusal is only used where the applicable law permits and is explained. We do not require an account simply to raise a privacy concern. Requests about a customer's processing are handled with that customer's involvement where appropriate.