# Your GDPR rights

Draft GDPR notice: your data protection rights for the ClarkCant Marketplace and the self-service tools to exercise them.

> **Draft — requires legal review before production launch.** This text describes how the service works today. It is not final legal terms, and placeholders marked TO BE CONFIRMED still need an owner's decision.

## Your rights

If the EU or UK GDPR applies to you, you have the right to access, correct, delete, restrict and port your personal data, and to object to processing. Where processing relies on consent (remembering your theme preference), you can withdraw consent at any time.

## Self-service

| Right | How |
| --- | --- |
| Access and portability | Export as JSON from [your account page](/account) or `GET /api/v1/me/export` |
| Rectification | Profile editing is not in the account page yet; contact us (below) |
| Erasure | Delete your account on the account page or `DELETE /api/v1/me` |
| Withdraw consent | **Cookie settings** in the site footer |
| Revoke access you gave to tools | Revoke API tokens, OAuth grants and linked devices on the account page |

For anything the tools do not cover, contact [TO BE CONFIRMED: privacy contact email]. We answer within one month.

## Legal bases

- Contract: running your account and the features you use.
- Legitimate interests: security, abuse prevention (rate limits, audit log) and operating the service.
- Consent: storing preferences such as your theme on your device.

## Transfers

The service runs on Cloudflare's global network, so data may be processed outside your country. [TO BE CONFIRMED: transfer mechanism, for example the Cloudflare Data Processing Addendum with Standard Contractual Clauses.]

## Complaints

You can complain to your local data protection authority. [TO BE CONFIRMED: lead supervisory authority, if any.]