Data Subject Rights Policy

Lexaris — PII Anonymization Platform
Document Reference: Anon-Legal-INT-25

This document is dynamically generated based on settings configured by the Operator in the Platform Admin Panel. Values shown in italics represent current settings and may be modified by the Operator within legally permitted limits.

---

1. Introduction

This Policy sets out the procedures by which Lexaris (IE Kudryavtsev S.A.) ("Controller") receives, assesses, and responds to requests from data subjects exercising their rights under Chapter III of Regulation (EU) 2016/679 ("GDPR") and equivalent applicable data protection legislation.

This Policy is binding on all personnel of the Controller who receive or handle data subject rights requests, and is incorporated by reference into the Controller's internal data protection procedures.

Key tension in Lexaris context: The Platform operates a session-based data retention model. Uploaded documents, token mappings, and detection results are typically destroyed automatically upon session completion or expiry of the user-configured retention period. This means that by the time a data subject rights request is received, the relevant session data may already have been permanently destroyed — making erasure moot and access impossible for that data category. This Policy addresses this dynamic throughout.

---

2. Rights Covered

This Policy addresses the following rights:

---

3. General Procedures

3.1 Submission Channels

Data subjects may submit rights requests through the following channels:

(a) Online Portal: lexaris.ru/account/privacy — authenticated users may submit and track requests directly through the Platform interface. This is the preferred channel as it facilitates identity verification.

(b) Email: privacy@lexaris.ru — requests submitted by email should include sufficient information for identity verification (see Section 3.3).

(c) Postal Mail: Data Protection Officer, Saint-Petersburg, Russia

The Controller does not accept rights requests submitted through social media platforms, informal support channels, the Telegram bot, or third-party intermediaries, unless accompanied by a valid power of attorney.

3.2 Acknowledgement

The Controller will send an acknowledgement of receipt within five (5) business days of receiving any data subject rights request. The acknowledgement will:
- Confirm the date of receipt (which starts the response clock);
- Identify the type(s) of right being exercised;
- State the verification requirements (if any remain outstanding);
- Provide a reference number for the request.

3.3 Identity Verification

To protect against fraudulent or unauthorised disclosure, the Controller will verify the identity of the person making the request. The level of verification is proportionate to the sensitivity of the data and the nature of the request:

Level 1 — Standard Verification (Authenticated Users)
For requests submitted through the authenticated Platform portal, the existing login session constitutes sufficient verification for most requests. No additional documentation is required.

Level 2 — Email Verification
For requests submitted by email from the registered account email address, the Controller will send a verification link to that address. Clicking the link confirms identity.

Level 3 — Enhanced Verification
Required for: large-volume access requests, portability exports, erasure of significant volumes of data, or where there is reasonable doubt about the requester's identity. The Controller may request one form of government-issued identification (redacted to show name and photograph only) or an alternative verification method agreed with the data subject.

Data Subjects of Uploaded Content (Third Parties):
Where a person whose PII appeared in a document uploaded by an End User submits a rights request, the Controller faces a particular challenge: the Controller may not hold sufficient information to identify whether that person's data was ever processed, especially given session-based retention. The Controller will:
(a) Confirm whether any data relating to the requester is currently held;
(b) If session data has already been destroyed, inform the requester that the data is no longer held;
(c) Where data is still within the retention period, coordinate with the End User who uploaded the document.

3.4 Response Timescales

3.5 No Fee — Exceptions

Responses to data subject rights requests are provided free of charge. The Controller may charge a reasonable administrative fee where requests are manifestly unfounded or excessive. Alternatively, the Controller may refuse to act on such a request, explaining its reasons and informing the data subject of their right to complain to a supervisory authority.

---

4. Right of Access — Article 15

4.1 Scope

Data subjects have the right to obtain from the Controller:

(a) Confirmation of whether personal data concerning them is being processed;

(b) If so, a copy of that personal data; and

(c) Supplementary information as specified in Article 15(1)(a)-(h).

4.2 Data Categories and Access Availability

4.3 Session Data Already Destroyed

Where session data (uploaded documents, token mappings, detection results) has been destroyed pursuant to the session-based retention policy before an access request is received, the Controller will:
(a) Inform the data subject that the data has been destroyed in accordance with the data minimisation principle;
(b) Confirm the categories of data that were processed and the general purposes of processing;
(c) Provide any metadata still available (e.g., job timestamps from usage logs within the 90-day window).

4.4 Format

Access responses are provided in PDF (human-readable) or JSON (machine-readable) format as requested.

---

5. Right to Rectification — Article 16

5.1 Self-Service Rectification

Account Data: End Users may correct their name, email address, and other profile information directly through the Platform's account settings.

5.2 Formal Rectification Request

Where self-service is not available, data subjects submit a formal rectification request to privacy@lexaris.ru specifying the data believed to be inaccurate and the correct data.

5.3 Uploaded Content

The Controller does not rectify personal data within uploaded documents, as:
(a) Uploaded documents are the End User's content, not the Controller's;
(b) The Platform's purpose is to anonymize PII, not to maintain accurate records of it;
(c) Session data is typically destroyed before a rectification request could be processed.

Where a data subject asserts that the Platform's NER pipeline misidentified or failed to identify their personal data in a document, this is addressed through the re-anonymization right (Section 12).

---

6. Right to Erasure — Article 17

6.1 The Session Lifecycle and Erasure

The right to erasure interacts uniquely with the Platform's session-based retention model:

Scenario 1 — Session data already destroyed:
If the uploaded document, token mapping, and detection results have already been destroyed per the retention policy, the erasure is effectively complete. The Controller will confirm that the data has been destroyed and provide a confirmation certificate.

Scenario 2 — Session data still within retention period:
If session data still exists (because the End User configured an extended retention period), the data subject may request immediate destruction of:
- The uploaded document containing their PII
- The corresponding token mappings
- The anonymized output (if it retains sufficient context for identification)

The Controller will execute this destruction within 5 business days and confirm completion.

Scenario 3 — Account data erasure:
Account data for End Users is deleted within 30 days (configured by Operator) of a valid erasure request, with propagation through backup systems completed within 90 days (configured by Operator).

6.2 Exceptions

The right to erasure does not apply where processing is necessary for:

(a) Compliance with a legal obligation — mandatory retention of financial records (typically 5-7 years depending on jurisdiction);

(b) Establishment, exercise, or defence of legal claims — the Controller may retain data where there is a pending or reasonably anticipated legal dispute.

Article 17(3) exemptions relating to legal claims preservation are less relevant for an anonymization service than for platforms that maintain legal case files, as the Controller does not hold case records on behalf of users.

6.3 Erasure Procedure

Step 1: Request received and identity verified.

Step 2: Data Protection team assesses which data categories exist and whether exceptions apply.

Step 3: Erasure executed:
- Account and profile data: deleted from active database within 5 business days
- Session data (if still retained): destroyed immediately
- Audit logs and security logs: anonymised (data subject identifier removed)
- Backups: propagation through backup cycles completed within 90 days

Step 4: Confirmation of erasure sent to data subject.

6.4 Account Deletion

End Users may delete their own Platform account through the account settings interface. Account deletion triggers the erasure workflow described above. All session data associated with the account that is still within the retention period is destroyed immediately.

---

7. Right to Data Portability — Article 20

7.1 Scope

The right to data portability applies where processing is based on consent or contract performance and carried out by automated means.

7.2 Portable Data Categories

7.3 Export of Anonymized Documents and Token Mappings

End Users can export anonymized documents and token mapping tables directly from the Platform interface during the session retention period. This self-service export functionality serves as the primary portability mechanism for session data.

Recommendation: End Users are strongly advised to export anonymized documents and token mappings during their session or within the configured retention period. Once the retention period expires, these data are permanently destroyed and cannot be recovered.

7.4 Procedure

Step 1: Request received through the online portal (preferred) or by email.

Step 2: Identity verified.

Step 3: Data export package prepared. For account-level data, export is available within 5 business days. For session data still within retention, export is provided immediately via the Platform interface.

Step 4: Export package made available via a secure, time-limited (14-day, configured by Operator) download link.

7.5 Format Standards

Exports are provided in JSON (structured data), CSV (tabular data), and original file formats (anonymized documents). Exports include a manifest file describing the content and structure of the export package.

---

8. Right to Restriction of Processing — Article 18

8.1 Grounds for Restriction

Data subjects may request restriction where the grounds set out in Article 18(1)(a)-(d) apply.

8.2 Effect of Restriction

During a period of restriction, the Controller stores the restricted data but does not otherwise process it. For session data, restriction may conflict with automated session destruction — where restriction is requested for data that would otherwise be destroyed, the Controller will preserve the data in a restricted state until the restriction is resolved, rather than destroying it.

8.3 Lifting Restriction

The Controller notifies the data subject before lifting a restriction.

---

9. Right to Object — Article 21

9.1 Objection to Legitimate Interest Processing

Data subjects may object to processing based on legitimate interests (Article 6(1)(f)) on grounds relating to their particular situation.

Upon receiving an objection:

Step 1: The Controller ceases processing the contested data immediately, pending assessment.

Step 2: The Controller assesses whether it has compelling legitimate grounds that override the data subject's interests.

Step 3: If compelling grounds are identified, the Controller notifies the data subject. If not, processing ceases permanently.

9.2 Objection to Anonymization Processing

Where a data subject objects to the processing of their personal data through the anonymization pipeline (e.g., a person whose PII appears in a document uploaded by another user), the Controller will:
(a) Assess whether session data is still retained;
(b) If so, cease processing and destroy the relevant data;
(c) If session data has already been destroyed, confirm that processing has already ended and data has been deleted;
(d) Note that the Controller cannot prevent future uploads by other End Users containing the same data subject's PII, as the Controller has no means of pre-screening uploaded content.

---

10. Rights Related to Automated Decision-Making — Article 22

10.1 No Solely Automated Decisions with Legal Effect

The Platform does not make decisions based solely on automated processing which produce legal effects or significantly affect data subjects. The NER pipeline detects PII and generates anonymization suggestions; the End User decides whether and how to apply anonymization.

10.2 Right to Request Human Review

If a data subject believes that automated processing by the Platform has affected them without adequate human involvement, they may request:
(a) Human review of the relevant detection and anonymization output;
(b) An explanation of the NER pipeline logic applied to their data;
(c) The opportunity to express their point of view.

10.3 Meaningful Information About NER Logic

Upon request, the Controller will provide a general description of:
- The NER detection methods used (regex, spaCy, Ollama);
- The categories of entity types detected;
- The general logic and confidence thresholds applied;
- The safeguards in place to prevent errors.

See also the International AI Processing Notice (Document 29).

---

11. Withdrawal of Consent — Article 7(3)

Where processing is based on consent, data subjects may withdraw consent at any time through:

• The Platform's Privacy Settings panel;
• A written request to privacy@lexaris.ru.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal, the Controller will cease the specific processing activity within five (5) business days, and erase data processed solely on the basis of the withdrawn consent unless another legal basis applies.

Ollama opt-out: Where an End User withdraws consent for Ollama-enhanced NER processing, the Platform reverts to spaCy + regex detection only. No Ollama processing occurs for that user's future sessions.

---

12. Right to Request Re-Anonymization

12.1 Scope

This is a contractual right offered by the Controller beyond GDPR requirements. End Users may request that a previously anonymized document be re-processed through an updated version of the NER pipeline (e.g., after a model update that improves detection accuracy for a specific entity type).

12.2 Conditions

Re-anonymization is available only where:
(a) The original document (or a copy) is still within the retention period, or the End User re-uploads the document;
(b) The End User has an active subscription;
(c) The request is for the End User's own documents (not third-party data subject requests).

12.3 Procedure

The End User re-uploads the document or initiates re-anonymization through the Platform interface. The Platform processes the document through the current version of the NER pipeline and generates a new anonymized output with an updated token mapping.

12.4 Third-Party Data Subjects

A third party whose PII appeared in a document processed by an End User cannot independently request re-anonymization, as the Controller does not hold the source document beyond the retention period. However, the third party may exercise their right to object (Section 9.2) or contact the End User directly.

---

13. Complaint Procedure — Article 77

If a data subject is dissatisfied with the Controller's response to a rights request, they may:

(a) Escalate to the DPO: Contact privacy@lexaris.ru requesting escalated review.

(b) Lodge a complaint with a supervisory authority: Data subjects have the right to lodge a complaint with the supervisory authority in the Member State of their habitual residence, place of work, or place of the alleged infringement.

(c) Seek judicial remedy (Article 79): Data subjects may bring proceedings before the courts of the Member State where the Controller is established, or where the data subject habitually resides.

The Controller does not penalise data subjects for exercising their rights or for lodging complaints.

---

14. Record Keeping

The Controller maintains a log of all data subject rights requests, including:

• Date of receipt and date of response;
• Type of right exercised;
• Identity verification method used;
• Outcome (granted, partially granted, refused) and reasoning;
• Any extension of the response period and reasons;
• Actions taken in response to the request;
• Whether session data had already been destroyed at the time of the request.

These records are retained for three years and are available to supervisory authorities upon request.

---

15. Contact

---

Configurable parameters

The following parameters are configured by the Operator in the Platform Admin Panel. Values shown below are defaults.

All parameters are configured in: Admin Panel → Settings → Retention Periods

---

This Policy constitutes a draft requiring review and approval by qualified legal counsel before publication and internal adoption.

Document Reference: Anon-Legal-INT-25 | Version Date: 2026-03-19