Legal
Your Privacy Rights
Last updated: March 15, 2026
This page explains how to exercise your privacy rights with Varnym LLC, the statutory timelines we follow, and what happens if your request is denied or partially denied.
1. Rights Available by Jurisdiction
EEA and UK (GDPR / UK GDPR): Access (Art. 15); rectification (Art. 16); erasure/right to be forgotten (Art. 17); restriction (Art. 18); portability (Art. 20); objection to legitimate interests or direct marketing (Art. 21); rights related to automated decision-making (Art. 22).
California (CCPA/CPRA): Right to know; access; correct (CPRA); delete; opt out of sale/sharing (not applicable); limit sensitive PI use (not applicable); non-discrimination.
Other US States (Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Iowa, and others): Access, correct, delete, portable copy, opt out of targeted advertising (not applicable), opt out of sale (not applicable), and appeal.
Canada (PIPEDA / Quebec Law 25): Access; challenge accuracy and completeness; de-indexation and re-indexation (Quebec); and information about automated decision-making producing effects.
Brazil (LGPD): Confirmation of processing; access; correction; anonymization, blocking, or deletion; portability; deletion; information about sharing; information about consent; revocation of consent.
Australia (Privacy Act 1988): Access to personal information; request correction of inaccurate or incomplete personal information.
2. How to Submit a Request
To submit a privacy rights request, email: admin@varnym.com
Please include in your request:
(a) The email address or phone number associated with your Varnym account;
(b) The specific right(s) you wish to exercise;
(c) Your jurisdiction or country of residence;
(d) For deletion requests: whether you want full deletion or account suspension; and
(e) Any specific data categories your request pertains to, if applicable.
Do not include payment card numbers or government ID numbers in your initial email. We will request only what is needed to verify your identity and process your request.
3. Identity Verification
To protect your personal data and prevent unauthorized disclosure or fraudulent deletion, we verify your identity before processing any request. Verification may include confirming the email or phone associated with your account, sending a verification code, or — for higher-risk requests — additional steps consistent with applicable law.
We will not require you to create a Varnym account solely to submit a privacy request. We will not use verification information for any purpose other than processing your request.
4. Response Timelines
EEA and UK (GDPR): 30 days. May extend by up to 2 additional months (total 3 months) for complex or high-volume requests, with notice within the initial 30-day period.
California (CCPA/CPRA): 45 days. May extend 45 additional days with notice.
Virginia, Colorado, Connecticut, Texas, and similar US states: 45 days. May extend 45 additional days with notice.
Canada (PIPEDA): 30 days. May extend with notice where permitted.
Brazil (LGPD): 15 days.
Australia (Privacy Act): 30 days.
Responses are provided in writing by email. We do not charge for requests unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline consistent with law.
5. Appeals and Internal Review
If we deny your request in whole or in part, we will provide a written explanation. You may appeal by submitting a written appeal to admin@varnym.com with the subject line "Privacy Rights Appeal," including your original request, the response received, and reasons for appeal.
Appeal timelines: EEA/UK — 30 days; California — 45 days; Virginia — 60 days; Colorado/Connecticut — 45 days; Canada — 30 days; Brazil — 15 days.
Appeals are reviewed by a different person than the initial reviewer. If denied, we will provide information for escalating to the relevant supervisory authority or consumer protection office.
6. Supervisory Authorities and Regulators
EEA: Your national data protection authority (https://edpb.europa.eu/about-edpb/about-edpb/members_en)
UK: Information Commissioner's Office (ICO): https://ico.org.uk
Canada: Office of the Privacy Commissioner: https://www.priv.gc.ca
Brazil: Autoridade Nacional de Proteção de Dados (ANPD): https://www.gov.br/anpd
Australia: Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au
US states: Your state attorney general's office.
7. Right to Non-Discrimination
We will not discriminate against you for exercising privacy rights. We will not deny goods or services, charge different prices, provide a lesser quality of service, or penalize you in any way because you exercised a right under applicable privacy law.
8. Authorized Agent Requests
California residents may designate an authorized agent to submit rights requests on their behalf. Requirements: (a) proof of your identity; (b) written authorization from you granting the agent authority (or proof of power of attorney under California Probate Code); and (c) verification of the agent's identity.
Submit authorized agent requests to admin@varnym.com with "Authorized Agent Request" in the subject line and all required documentation attached.
9. SMS Consent and Messaging Data
Records of your SMS consent status, timestamp, and source are retained per the retention schedule in our Privacy Policy (account life plus 3 years) to meet TCPA carrier compliance requirements. These retention periods apply even after a general account deletion request.
To opt out of SMS messages, reply STOP to any message at any time. To request deletion of SMS consent records beyond what is required for legal compliance, contact admin@varnym.com with a specific TCPA consent deletion request. We will advise what can and cannot be deleted under applicable law.