Privacy Rights Requests
Access, deletion, correction and appeal.
Privacy Rights Requests is not yet published.
The text below is a draft awaiting legal review. It is not in force, no part of it creates any obligation or right, and nothing on this page should be relied on. Passages marked [TO BE CONFIRMED] are values that have deliberately been left blank rather than guessed.
Catomni Studio handles information about children, so these documents go to a lawyer before they take effect rather than being generated and published.
If you need answers about how your data is handled before these are published, contact your studio directly.
Draft revised: 2026-08-17
Notes for legal review
Open questions and drafting assumptions in this document. These notes are removed when the document goes into force.
- DRAFT for review. Response timelines are drafted to the statutory maxima (45 days under the CCPA, extendable by a further 45; one month under the UK/EU GDPR, extendable by two). Confirm these are operationally achievable, since they become commitments.
- The appeal route in section 7 is required by Virginia, Colorado, Connecticut and several other state laws. It cannot function without a monitored contact address.
- Section 3 declines to act on requests about a studio's records, referring them to the studio instead. This is the correct processor posture and follows from the studio-as-controller assumption, but confirm the wording — a data subject reading it must not conclude that nobody will help them.
- Identity verification is drafted in general terms deliberately: an over-specified process invites collecting more identity documentation than is warranted.
1. What rights you may have
Depending on where you live and your relationship with us, you may have some or all of the following rights over your personal information:
- To know what we hold about you, why, and who we share it with.
- To get a copy of it, in a portable form where that applies.
- To have inaccurate information corrected.
- To have it deleted.
- To object to or restrict certain processing.
- To withdraw a consent you previously gave, at any time.
- Not to be discriminated against for exercising a right.
- To appeal if we refuse your request.
We do not sell personal information and do not share it for cross-context behavioural advertising, so there is no opt-out of those to offer. We do not use automated decision-making that produces legal or similarly significant effects about anyone.
2. Which request is yours to make, and to whom
This is the part worth getting right first, because it determines who can actually help you.
| If you are… | And your request is about… | Ask… |
|---|---|---|
| A parent, guardian or student | A student record, attendance, progress, family details or tuition | Your studio. It controls that information and can act on your request immediately. |
| Studio staff | Your own staff account and profile | Your studio for its own records, or Shannon Cyber Services, LLC for the account we hold for you. |
| A studio (our customer) | Your subscription, billing or account with us | Shannon Cyber Services, LLC. |
| Anyone | An enquiry you sent us through our website, or marketing from us | Shannon Cyber Services, LLC. |
3. Requests about a studio's records
For student and family information, the studio is the controller and we process it on the studio's instructions. If you send us a request about that information, we will forward it to the studio where we can identify which one it concerns, tell you that we have done so, and help the studio respond.
We will not delete or change a studio's records at the request of someone other than the studio. That is not an unwillingness to help — we have no way to verify who is entitled to make decisions about a particular child's record, and acting on an unverified request could itself cause harm. The studio knows its families and can verify you far more reliably than we can.
4. How to make a request to us
Email [TO BE CONFIRMED: privacy contact email], or write to us at [TO BE CONFIRMED: registered address]. Please tell us:
- What you would like us to do — access, copy, correct, delete, object, or withdraw consent.
- Enough information for us to find your records, such as the email address you use with Catomni and the studio involved.
- Where you are located, since that determines which rights apply.
There is no charge. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, or repetitive — and we will explain why if that happens.
5. Verifying who you are
We need to be reasonably sure of your identity before acting, because disclosing or deleting information at the request of the wrong person is itself a privacy harm. Usually we can verify you by corresponding through the email address already on your account. If we cannot, we will ask for what we need and no more, and we will not use anything you send for verification for any other purpose.
An authorised agent may make a request on your behalf with written authority from you. We may still contact you to confirm it.
6. How long we take
- We acknowledge requests promptly, normally within 10 days.
- Where a US state privacy law applies, we respond within 45 days, and may extend by a further 45 days where reasonably necessary, telling you the reason before we do.
- Where the UK or EU GDPR applies, we respond within one month, extendable by up to two further months for complex requests, telling you the reason before we do.
7. If we say no, or you are unhappy
We will explain why in writing. You may appeal by replying to our decision and saying you wish to appeal — write to [TO BE CONFIRMED: privacy contact email] with "Appeal" in the subject line. We will review the decision and tell you the outcome, with reasons, within 45 days.
You may also complain to a regulator. In the UK that is the Information Commissioner's Office; in the EEA, your national supervisory authority; in the United States, your state Attorney General. Complaining to a regulator does not affect any other rights you have.
8. Children
A parent or guardian may exercise these rights on behalf of their child. The Children's Privacy Notice explains what is held about a child and how to review or delete it — and again, the studio is the fastest route.