Data subject requests
How to exercise your rights to access, correct, erase, restrict, object, port your data and withdraw consent, what is self-service, how long a reply takes, and how to complain.
The Nigeria Data Protection Act 2023 gives you rights over your personal data. Here is how to use each one in Breno.
Rights and how to use them#
| Right | How |
|---|---|
| Be informed | The privacy notice and these docs. |
| Access | Self-service: Download my data (a personal export that includes account.json: your profile, sign-in events, sessions and notifications). Anything else, write to us. |
| Correct | Edit your profile and your own items in the product. For anything you cannot edit, write to us. |
| Erase | Self-service: delete items, or your whole account, from Settings, then Security. See Delete your data. |
| Restrict or object | Write to us. A legal hold can also pause deletion of a workspace's data. |
| Take it with you | Self-service: Export your knowledge as Markdown, JSONL and original files. See Export your knowledge. |
| Withdraw consent | Where consent is the basis, tell us and the processing stops. Cookie choices can be changed at any time in the cookie notice. |
| Not be subject to a solely automated decision | Write to us. Breno does not use your data to make decisions about you; see the privacy notice. |
Self-service, in detail#
- Export is complete: items, their sources and relationships, your original files, and checksums. It contains what you can read. See Export format.
- Deletion previews exactly what it will do before you confirm, and purges your private content. Items you added to a shared workspace stay with the workspace and show as added by a former member, because they are not yours alone.
For administrators#
Under Settings, then Compliance, administrators can run, for one member:
- a data export of everything held about them;
- a right to erasure, confirmed by typing the member's email; and
- an audit trail export (JSON) for a time window, as a record of what was done.
Erasure anonymizes personal identifiers while keeping the records needed for integrity and security, which is the accepted approach where a legal basis requires a record to remain.
Writing to us#
Email contact@breno.ng or use the contact form. Say which right you are exercising, and which workspace or account it concerns. We may need to confirm that you are the person the data is about before acting, and will say so.
How long a reply takes#
We aim to answer within 30 days. A complex request can take longer, and you will be told why. If we refuse a request, we say which ground we relied on: for example, a law that requires the data to be kept, or another person's rights.
If your organization runs the workspace#
Your organization is the data controller for that workspace. Ask its administrator first; they can see and act on things we cannot.
If you are not satisfied#
You can complain to the Nigeria Data Protection Commission, the regulator established by the Act, at ndpc.gov.ng, and you may also have a remedy in court. Nothing here takes either away.