How to Request Your Data

You have the right to:

1. Access your data — get a copy of everything we store about you
2. Rectify inaccurate data — correct or update your information
3. Erase your data — request full deletion ("right to be forgotten")
4. Restrict processing — limit how we use your data
5. Data portability — receive your data in a machine-readable format
6. Object to processing based on legitimate interests, and to direct marketing at any time
7. Withdraw consent — revoke any consent you gave
8. File a complaint — with the Italian Data Protection Authority (Garante)

Send an email to support@poliprep.com with:

Subject line: Data Request — [Type of request]

(e.g., Data Request — Access, Data Request — Erasure, Data Request — Correction)

Body should include:

• Your full name
• The email address associated with your PoliPrep account (or the email you used to join the waitlist / contact us, if you don't have an account)
• Which right(s) you want to exercise
• Specific details of your request (for example: "I want to correct my last name from X to Y", or "Please delete my account and all associated data")

Some requests can be handled directly in your account settings:

• Account deletion: Settings → Privacy & data → Delete account
• Data export: Settings → Privacy & data → Download your data
• Update information: Settings → Profile
• Emails: use the unsubscribe link at the bottom of any PoliPrep email

For requests not covered by in-app controls, use Option 1 (email).

To protect your data from unauthorized requests, we may need to verify your identity before responding. We typically ask you to confirm:

• The email address on your account
• Recent activity (e.g., the last course you accessed, an approximate purchase date)

In rare cases where the request is high-risk (e.g., account deletion of a paying customer with active enrollments), we may request additional verification such as a copy of an ID document. This is used only to verify identity and is deleted immediately after verification.

We will NOT ask for your password. Legitimate requests never require you to share your password.

We respond to all requests without undue delay and in any event within one month of receipt, as required by GDPR Art. 12(3).

For complex or numerous requests, we may extend this by up to two further months and will inform you of the extension, with the reasons, within the first month.

If we cannot fulfill your request (e.g., due to legal retention obligations), we will explain why and inform you of your right to file a complaint.

Exercising your GDPR rights is free of charge.

We may charge a reasonable fee only if a request is:

• Manifestly unfounded or excessive (in particular, repetitive requests within a short period), or
• If you request additional copies of information already provided

We will inform you of any fee before proceeding.

When you request erasure ("right to be forgotten") and we approve it:

Deleted without undue delay (at the latest within one month):

• Your account and profile
• Learning activity data (attempts, scores, session records)
• Support communications
• Marketing preferences

Retained for legal reasons:

• Purchase and invoice records: kept for 10 years as required by Italian law (Art. 2220 of the Civil Code and applicable tax legislation). Invoices must be kept exactly as issued, so they cannot be altered, but access to them is restricted and they are used only to meet legal obligations.
• Backup copies: retained for up to 90 days in secure backups, then permanently deleted during backup rotation.

We will inform you of exactly what has been deleted and what remains, and why.

We may not be able to fulfill an erasure request when:

• We have a legal obligation to retain the data (e.g., tax records)
• The data is needed to establish, exercise, or defend legal claims
• Deletion would prevent us from fulfilling a contract you are still party to (e.g., an active cohort enrollment)

In these cases, we can typically fulfill a partial deletion or restrict processing instead. We will explain the specific reasons in our response.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with a data protection authority.

Italian Data Protection Authority (Garante per la protezione dei dati personali):

• Website: https://www.garanteprivacy.it
• Address: Piazza Venezia 11, 00187 Roma, Italy
• Email: protocollo@gpdp.it

You can also contact the supervisory authority in your EU country of residence.

Email: support@poliprep.com

Address: Islam Fakrul, Via Belmonte 6, 10155 Turin, Italy

P.IVA: 13489590011