In short
Privacy laws differ in the details, but they give people broadly the same rights over their personal data. We honour those rights for everyone, wherever you are, through one channel: email info@dictode.com. This page sits alongside the privacy policy (what we collect and why), the cookie policy and the data processing addendum (how we handle personal data on a customer's behalf).
Who is responsible for what
We are the controller (the data fiduciary under India's law) for the personal data we collect for ourselves: enquiries sent to us, the accounts of people who use Klayara, billing records, and the technical logs of this website.
Our customers are the controller for the personal data inside the systems they connect to Klayara and the tables they import, such as details of their own customers or staff. For that data we are their processor and act only on their instructions, as set out in the data processing addendum. If your data is in a customer's workspace and you want to use your rights, contact that organisation; if you contact us instead, we will pass your request to them.
Your rights
Depending on the law that applies to you, you have some or all of these rights:
| Right | What it means |
|---|---|
| Know and access | Ask what personal data we hold about you, why, where it came from and who we share it with, and get a copy. |
| Correct | Have inaccurate or incomplete data put right. |
| Delete | Have your data erased when we no longer need it or you withdraw consent, unless the law requires us to keep it (billing records, for example). |
| Export | Receive data you gave us in a common, machine-readable format, or have it sent to another provider. |
| Object and restrict | Object to processing based on our legitimate interests, or ask us to pause processing while a question is resolved. |
| Withdraw consent | Where we rely on your consent, withdraw it at any time, as easily as you gave it. |
| Not be subject to automated decisions | Klayara makes no decisions about you with legal or similarly significant effects by automated means alone. |
| Complain | Raise a concern with us first, and with your data protection authority at any time. |
How to make a request
- Email info@dictode.com with the subject “Privacy request” and say which right you want to use. You can also ask someone to make the request for you.
- We may ask you to confirm your identity, usually by replying from the email address on your account, so that we never hand your data to someone else.
- We reply within 30 days, or sooner where your law sets a shorter period. If a request is complex we will tell you within that time why we need longer and how long.
- Requests are free. If we cannot do what you ask, for example because the law requires us to keep a billing record, we explain why.
- We will not treat you differently for using any of your rights.
European Union and UK (GDPR)
If you are in the European Union, Iceland, Liechtenstein or Norway, the General Data Protection Regulation (EU) 2016/679 applies. In the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply.
- Legal bases. We process personal data to perform our contract with you (running your account and workspace), to meet legal obligations (tax and billing records), for our legitimate interests in answering enquiries and keeping the service secure, and with your consent where we ask for it. The privacy policy maps each use to its basis.
- Transfers outside Europe. Where personal data leaves the EEA or the UK, we rely on an adequacy decision or on safeguards the law recognises, such as the European Commission's standard contractual clauses and the UK addendum to them. Customers choose the region their workspace data is stored in, or run Klayara on their own servers.
- Complaints. You can complain to the data protection authority in the country where you live or work, or where you think a breach happened. In the UK that is the Information Commissioner's Office.
India (DPDP Act)
The Digital Personal Data Protection Act, 2023 and the rules made under it give you the right to information about how your data is processed, to correction, completion, updating and erasure, to grievance redressal, and to nominate someone to use your rights if you die or become unable to. Where we rely on your consent you can withdraw it at any time. Send grievances to info@dictode.com; if you are not satisfied with our answer, you may approach the Data Protection Board of India.
Gulf and Middle East
We handle requests under the personal data laws of the region in the same way, including:
- United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the separate data protection laws of the DIFC and ADGM free zones where they apply.
- Saudi Arabia: the Personal Data Protection Law and its regulations, overseen by the Saudi Data and AI Authority (SDAIA).
- Qatar: Law No. 13 of 2016 on the Protection of Personal Data Privacy.
- Bahrain: Law No. 30 of 2018 on the Protection of Personal Data.
- Oman: the Personal Data Protection Law issued by Royal Decree 6/2022.
- Kuwait: the Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority (CITRA).
- Egypt: Law No. 151 of 2020 on the Protection of Personal Data.
Several of these laws restrict moving personal data out of the country. Customers can keep workspace data in the cloud region they choose, or keep it entirely on their own servers with the self-hosted edition.
Singapore, Malaysia and Indonesia
- Singapore: the Personal Data Protection Act 2012 gives you rights of access and correction and the right to withdraw consent. You can complain to the Personal Data Protection Commission.
- Malaysia: the Personal Data Protection Act 2010, as amended in 2024, gives you rights of access and correction, the right to withdraw consent, and the right to have your data moved to another provider.
- Indonesia: Law No. 27 of 2022 on Personal Data Protection gives you rights to information, access, correction, deletion and the end of processing, and to withdraw consent.
United States, Canada and Australia
- California and other US states: under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and similar state laws, you can ask to know, correct and delete your personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer anything about you, so there is nothing to opt out of.
- Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you rights of access and correction. You can complain to the Office of the Privacy Commissioner of Canada.
- Australia: the Privacy Act 1988 and the Australian Privacy Principles give you rights of access and correction. You can complain to the Office of the Australian Information Commissioner.
For customers: meeting your own obligations
When you put personal data in Klayara, the law that applies to it is yours to meet, and the product gives you the means to do so:
- Least access: row-level security limits which rows each person sees, and column masking hides sensitive columns such as salaries or phone numbers.
- Accountability: the workspace activity log records changes, data exports and views through public links and embeds, with who did them and when.
- Data minimisation: live connections read data where it already sits, and you choose table by table what to import.
- Erasure: deleting a table or workspace removes its data permanently after the 30-day restore window.
- Data location: choose the cloud region, or self-host so that no data reaches us.
- Contract: the data processing addendum covers processor terms, sub-processors, breach notice and transfers.
We will help you answer requests from the people whose data you hold, and give you the information you need for your own records and risk assessments.
What this page is and is not
This page explains how we handle the rights these laws give you. It is not legal advice, and it is not a certificate of compliance with any law or standard. Laws change: we review this page when they do, and the date above shows when it was last updated.
Contact
Questions about this document: info@dictode.com. Dictode is the company behind Klayara.