11.1 Rights Available to All Users
Regardless of your jurisdiction, you may contact us at [email protected] to:
(a) Request information about the Personal Data we hold about you;
(b) Request correction of inaccurate Personal Data;
(c) Request deletion of your Personal Data, subject to legal retention requirements;
(d) Withdraw consent for Processing where consent is the legal basis.
11.2 California Residents - CCPA/CPRA
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
(a) Right to Know. You have the right to request disclosure of the categories and specific pieces of Personal Data we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.
(b) Right to Delete. You have the right to request deletion of your Personal Data, subject to certain legal exceptions (e.g., fraud prevention, legal compliance, transaction completion).
(c) Right to Correct. You have the right to request correction of inaccurate Personal Data.
(d) Right to Opt-Out of Sale/Sharing. We do not "sell" or "share" (as defined under the CCPA/CPRA) your Personal Data for cross-context behavioral advertising. No opt-out is necessary.
(e) Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.
(f) Categories of Personal Data Collected. In the preceding twelve (12) months, we have collected the following categories of Personal Data as defined by the CCPA: Identifiers (name, email, IP address, device ID); Commercial Information (purchase history, transaction records); Internet or Electronic Network Activity (browsing history, interactions with the Platform); Geolocation Data (country code); and Biometric Information (collected by Persona for KYC, not by Ferm directly).
(g) Authorized Agents. You may designate an authorized agent to submit requests on your behalf by providing written authorization.
11.3 European Economic Area and United Kingdom - GDPR / UK GDPR
If you are located in the EEA or the United Kingdom, the following provisions apply:
(a) Lawful Bases for Processing. We Process your Personal Data under the following lawful bases:
| Lawful Basis | Applicable Processing |
|---|
| Performance of a contract | Providing the Service, processing transactions, managing your account |
| Compliance with legal obligations | AML/KYC verification, sanctions screening, tax record retention |
| Legitimate interests | Fraud prevention, platform security, analytics, enforcing Terms, direct marketing subject to your right to object or unsubscribe |
| Consent | Biometric collection via Persona |
(b) Your Rights. You have the right to:
(i) Access - request confirmation of whether we Process your Personal Data and obtain a copy thereof;
(ii) Rectification - request correction of inaccurate or incomplete Personal Data;
(iii) Erasure - request deletion of your Personal Data where there is no compelling reason for continued Processing;
(iv) Restriction - request restriction of Processing in certain circumstances;
(v) Data Portability - receive your Personal Data in a structured, commonly used, machine-readable format;
(vi) Object - object to Processing based on legitimate interests or for direct marketing purposes;
(vii) Withdraw Consent - withdraw consent at any time where Processing is based on consent, without affecting the lawfulness of Processing prior to withdrawal.
(c) Supervisory Authority. You have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en. The relevant UK authority is the Information Commissioner's Office (ICO) at https://ico.org.uk/.
(d) International Transfers. Where your Personal Data is transferred outside the EEA/UK, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to ensure an adequate level of protection.
11.4 Canadian Residents - PIPEDA
If you are a Canadian resident, the following rights apply under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws:
(a) Right to Access. You have the right to request confirmation of whether we Process Personal Data relating to you and to obtain a copy thereof.
(b) Right to Correct. You have the right to request correction of inaccurate, outdated, or incomplete Personal Data.
(c) Right to Withdraw Consent. You may withdraw consent for the collection, use, or disclosure of your Personal Data at any time, subject to legal or contractual restrictions and reasonable notice.
(d) Contact. If you have questions or concerns about our privacy practices, please email [email protected]. You may also contact the Office of the Privacy Commissioner of Canada at (800) 282-1376.
11.5 Australian Residents - Privacy Act 1988
If you are an Australian resident, the following rights apply under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs):
(a) Right to Access. You have the right to request access to the Personal Data we hold about you.
(b) Right to Correct. You have the right to request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading Personal Data.
(c) Complaints. If you believe we have breached the APPs, you may lodge a complaint with us at [email protected]. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au/.
11.6 U.S. State Biometric Privacy Laws
(a) Illinois Biometric Information Privacy Act (BIPA). If you are an Illinois resident, you have the right to written notice of collection, the specific purpose, the length of term, and a written release before capture. Ferm presents that notice and release before Persona camera or biometric capture begins. The retention period on that notice is the configured Persona period. If no period is configured, Illinois capture is not offered. Biometric Data is not sold, leased, or traded.
(b) Texas Capture or Use of Biometric Identifier Act (CUBI). If you are a Texas resident, the same protections apply. Biometric identifiers are collected solely for identity verification, are not sold or disclosed except as permitted by law, and are destroyed within a reasonable time after the purpose is fulfilled.
(c) Washington State Biometric Privacy Law (RCW 19.375). If you are a Washington resident, you are hereby notified that Biometric Data is collected for the commercial purpose of identity verification. You may request deletion by contacting [email protected].
(d) Additional U.S. State Laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA). Residents of these states may exercise rights to access, correct, delete, and opt-out of certain Processing as applicable under their respective state privacy laws by contacting [email protected].
