GDPR & Your Rights
Reading note. Each right section explains what the right is and, importantly, how to exercise it on Tirvea - through a self-service feature where one exists, or on request where it does not.
1. Purpose
Purpose. To explain, in one place, your rights under the EU and UK General Data Protection Regulation (GDPR) in respect of the personal data WiseWave Limited processes on Tirvea, and how to exercise each right. WiseWave Limited is the Data Controller (Privacy Policy §4, /legal/privacy).
2. Legal Framework
Purpose. To identify the law. Your rights arise under the GDPR (Regulation (EU) 2016/679) and, as applicable, the UK GDPR, as supplemented by Irish data-protection law. This Policy explains those rights as they apply to Tirvea; it does not create rights beyond the law.
3. Definitions
Purpose. To define terms specific to this Policy. Data-protection terms (Personal Data, Controller, Processor, Processing, Special Category Data) are defined in the Privacy Policy (/legal/privacy).
- "Data-subject request" - a request to exercise one of the rights in this Policy.
- "Self-service" - a right you can exercise directly through a feature in the Service.
- "On request" - a right you exercise by contacting us at info@tirvea.com.
- "Supervisory authority" - the data-protection regulator (for us, the Irish Data Protection Commission).
4. Your Rights at a Glance
Purpose. A summary of your rights and how to exercise each on Tirvea.
| Right (GDPR) | How to exercise on Tirvea |
|---|---|
| Access (Art. 15) | Self-service data export (§5), or on request |
| Rectification (Art. 16) | Self-service in account settings (§6), or on request |
| Erasure (Art. 17) | Self-service account deletion (§7) |
| Restriction (Art. 18) | On request (§8) - no self-service control |
| Object (Art. 21) | On request (§9) - no self-service control |
| Portability (Art. 20) | Self-service data export (§10) |
| Automated decisions (Art. 22) | Appeals / human review (§11) |
| Withdraw consent (Art. 7(3)) | Self-service for biometric consent (§12), or on request |
| Complain to a regulator (Art. 77) | Irish Data Protection Commission (§17) |
5. Right of Access
Purpose. To let you obtain a copy of, and information about, the personal data we hold about you. You can exercise this right through the self-service data export, which produces a downloadable copy of your personal data (account, profile, interests, photos, likes, matches, messages, and payment records). You may also request access by contacting us. The categories, purposes, and legal bases of our processing are set out in the Privacy Policy (/legal/privacy).
6. Right to Rectification
Purpose. To let you correct inaccurate personal data and complete incomplete data. You can edit much of your information directly in your account settings (for example, profile and account details). For information you cannot self-edit (for example, verification records), contact us at info@tirvea.com.
7. Right to Erasure
Purpose. To let you delete your personal data ("right to be forgotten"). You can request deletion of your account yourself; your account then enters a deactivated state with a 30-day grace window during which you can cancel by signing in, after which it is deleted. Some records are retained where the law or a legal hold requires, as set out in the Data Retention Policy (/legal/data-retention) and Account Deletion Policy (/legal/account-deletion).
8. Right to Restriction
Purpose. To let you ask us to limit our processing in certain circumstances (for example, while we verify contested data). This right is exercised on request, by contacting us at info@tirvea.com; there is no self-service control for it. [Legal review required before publication - confirm the restriction-request handling; no self-service mechanism is implemented.]
9. Right to Object
Purpose. To let you object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to direct marketing. This right is exercised on request, by contacting us at info@tirvea.com; there is no self-service control for it. Where you object to marketing, we will stop; where you object to legitimate-interests processing, we will stop unless we can show compelling legitimate grounds. [Legal review required before publication - confirm the objection-request handling; no self-service mechanism is implemented.]
10. Right to Portability
Purpose. To let you receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible. You can exercise this right through the self-service data export, which provides your personal data as a JSON document.
11. Rights Related to Automated Decision-Making
Purpose. To explain your rights where decisions are automated. Where a decision is based solely on automated processing and produces legal or similarly significant effects, you have the right to obtain human intervention, express your view, and contest the decision. On Tirvea, decisions informed by automated systems can be challenged through the Appeals Policy (/legal/appeals), where a person reviews them, and our use of automation is described in the AI Moderation Policy (/legal/ai-moderation) and Privacy Policy (/legal/privacy).
12. Withdrawal of Consent
Purpose. To let you withdraw consent where our processing relies on it. You can withdraw biometric (face) consent yourself in privacy settings, which stops the comparison and deletes the associated face reference (Biometric Information Policy, /legal/biometric-data). Withdrawal does not affect the lawfulness of processing before withdrawal. Withdrawal of non-essential cookie consent is described in the Cookie Policy (/legal/cookies). [Legal review required before publication - the cookie-consent preference tool is not yet wired (see the Cookie Policy).]
13. How to Make a Request
Purpose. To explain how to exercise your rights. For access, rectification, erasure, portability, and biometric-consent withdrawal, use the self-service features described above. For restriction, objection, or any request you cannot complete in the Service, contact us at info@tirvea.com. We may ask for information to locate your data and confirm your identity (§14).
14. Identity Verification
Purpose. To protect your data by confirming who is making a request. Self-service rights require you to be signed in to your account. For requests made by email, we take reasonable steps to verify your identity before acting, and we may ask for information to confirm it, so that we do not disclose or change data for the wrong person. We ask only for what is necessary and proportionate.
15. Response Time
Purpose. To set expectations on timing. We respond to a data-subject request without undue delay and within one month of receipt. Where a request is complex or where you have made a number of requests, we may extend this by up to two further months, and we will tell you within the first month if we need to. We do not charge a fee except where a request is manifestly unfounded or excessive, as the law permits.
16. Appeals
Purpose. To explain how to challenge a decision about your data or an enforcement action. If we refuse or restrict a request, we will explain why and how to challenge it. Enforcement and moderation decisions can be appealed under the Appeals Policy (/legal/appeals).
17. Complaints
Purpose. To explain how to complain to a regulator. If you are unhappy with how we handle your data or your request, please contact us first at info@tirvea.com so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Irish Data Protection Commission; you may also complain to the authority in your country of residence or work. [Legal review required before publication - confirm the current Data Protection Commission contact details and any lead-authority position.]
18. International Transfers
Purpose. To explain transfers relevant to your rights. Where your data is processed outside the EEA by a provider, an appropriate transfer mechanism under Chapter V of the GDPR applies, as described in the Privacy Policy §39 (/legal/privacy). This Policy does not repeat that analysis.
19. Security
Purpose. To confirm we protect your data when handling requests. We handle data-subject requests securely, disclose data only to the verified data subject, and apply the safeguards in the Security Policy (/legal/security) and Privacy Policy (/legal/privacy).
20. Updates
Purpose. To explain how this Policy changes. We update this Policy to reflect changes in our practices or the law - including when we add self-service controls for rights currently handled on request. We update the "Last Updated" date and, for material changes, take reasonable steps to communicate them.
21. Contact
Purpose. To tell you how to reach us about your rights.
- Data Controller: WiseWave Limited (Company Number 762171)
- Registered office: 39 Cooley Park, Dundalk, Co. Louth, A91 AP2V, Ireland
- Email: info@tirvea.com
For what we process and why, see the Privacy Policy (/legal/privacy); for how long we keep data, the Data Retention Policy (/legal/data-retention).