Under the General Data Protection Regulation (GDPR), EU/EEA residents have the following rights regarding their personal data.
This document is provided in English, which is the authoritative and legally governing version. Any translation is for convenience only.
You have the right to request a copy of the personal data we hold about you, including your profile, learning history, and session records. To exercise this right, use the data export feature in your account settings, or contact us directly.
If any personal data we hold is inaccurate or incomplete, you have the right to request that we correct it. You can update your profile information directly in account settings, or contact us for corrections we cannot make available to you directly.
You can request deletion of your personal data from Account Settings → Delete Account. The standard flow includes a 7-day grace period during which you can cancel the request. To exercise GDPR Right-to-Erasure with no grace period, check the “Request immediate erasure” option on the deletion page; your request will be processed within 24 hours. We retain financial records and certain compliance-required data as permitted by Article 17(3); we will inform you of any such retention in writing on request.
You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON), and to transmit it to another controller. Use the Export My Data option in account settings to download a complete copy of your data.
You have the right to object to the processing of your personal data in certain circumstances, including processing for direct marketing purposes. We do not sell your data or use it for third-party marketing. To object to any specific processing, please contact us.
You may request that we restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved.
You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Hanlexon uses automated systems to personalize learning recommendations, but no legally significant decisions are made automatically without human review.
To submit a GDPR request, contact our privacy team:
We will respond to your request within 30 days. In complex cases we may extend this by a further two months, but will inform you of any such extension.
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.