Data Subject Requests

Individuals can exercise rights over the personal information we hold about them. This page explains how to submit a request and what happens next. The specific rights available depend on the law that applies to you — see our GDPR, CCPA/CPRA, and UAE PDPL pages.

How to submit

Email privacy@opendoors.ai with “Data Subject Request” in the subject.
Include: the right you are exercising, the email and phone you used when interacting with us, and any workspace or account identifier if known.
If you are submitting on someone else’s behalf (authorised agent, parent/guardian), attach signed authorisation and proof of identity for both parties.

Verification

To protect your information, we verify your identity before acting on a request. Verification steps depend on the sensitivity of the request but typically include confirming details from your account and sometimes a verification email or SMS to a known address.

Response times

Law	Target	Extension
GDPR / UK GDPR	30 days	Up to +60 days for complex requests, with notice.
CCPA / CPRA	45 days	Up to +45 days with notice.
UAE PDPL	Reasonable period, typically 30 days	With notice for complex matters.

When the data is not ours to control

If your personal data is held in an Open Doors customer’s workspace (for example, they imported you as a contact), that customer is the controller of your data. We will refer your request to them and assist them to respond. Where possible, we will forward your request directly and copy you.

Cost

Handling your request is free. Repeated, unfounded, or manifestly excessive requests may attract a reasonable fee or be refused — rare in practice.

Complaints

If you are unhappy with our response, contact us to discuss. You may also lodge a complaint with your supervisory authority — the EU data-protection authority of your member state, the UK Information Commissioner’s Office, the California Privacy Protection Agency, or the UAE Data Office.