Your Privacy Rights

The short version

You can ask us what we hold about you, get a copy, correct it, delete it, or object to how it's used — regardless of where you live. One email does it: privacy@crutan.com. We respond within 30 days, verify requests, and never discriminate for exercising rights.

Two situations, two paths

• You visited crutan.com or talked to us (lead forms, tools, demo) — Crutan is the controller. Exercise rights directly with us as described below.
• You received a page generated by one of our customers— that customer is the controller and Crutan is their processor. We'll forward your request to them within 5 business days, and on their instruction (or where the law requires) act on it directly.

Rights under GDPR / UK GDPR

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate data.
• Erasure — deletion, where no overriding legal basis applies.
• Portability — machine-readable export of data you provided.
• Restriction & objection — including an absolute right to object to direct marketing.
• Withdraw consent — where processing relies on it, at any time.
• Complain — to your supervisory authority; we'd appreciate the chance to resolve it first.

Our lawful bases: legitimate interest for B2B marketing and site analytics, contract for providing the product, consent where we ask for it explicitly. International transfers are covered by Standard Contractual Clauses — see the DPA.

Rights under CCPA / CPRA (California)

• Know / access — categories and specific pieces of personal information collected.
• Delete — subject to statutory exceptions.
• Correct — inaccurate personal information.
• Opt out of sale/share — we do not sell or share personal information as defined by the CPRA, so there is nothing to opt out of.
• Limit sensitive PI — we don't collect sensitive PI on this site.
• Non-discrimination — same service and pricing whether or not you exercise rights.

Categories we collect (CCPA disclosure)

Retention

Lead and contact records: 24 months from last interaction, then deleted or anonymized. Analytics events: 12 months. Customer workspace data: lifetime of the contract plus 30 days. Backups roll off within 35 days of deletion.

How to exercise any right

1. Email privacy@crutan.com from the relevant address (or describe it).
2. Tell us which right you're exercising — no special format required.
3. We verify, act within 30 days (45 with notice for complex requests), and confirm in writing. Authorized agents may submit requests with proof of authorization.

See also: Privacy Policy · Cookie Policy · DPA · Subprocessors