Your GDPR Rights

1. Introduction

Gruther, a company incorporated under the laws of France, with its registered office at 19 boulevard Malesherbes, 75008 Paris, France, publishes lensx.tech and operates LensX, a business-to-business platform that connects an organization’s HR, finance, and operations records into one deterministic data layer and lets authorized people reason over it with AI assistance.

This page sets out the rights available to individuals whose personal data we process, and how to use them. It applies to you if the General Data Protection Regulation covers the processing of your data, which is generally the case where you are in the European Economic Area. Section 9 covers the French law that supplements it.

What we process, why, and on what legal basis is set out in our Privacy Policy. This page is about the rights themselves.

2. Right of access (Article 15)

You may ask us to confirm whether we process personal data about you and, if we do, to give you a copy of it, together with information about the purposes, the categories of data, who it is disclosed to, how long we keep it, where it came from, and any transfer outside the European Economic Area and the safeguards applied to it. The first copy is free.

3. Right to rectification (Article 16)

You may ask us to correct personal data about you that is inaccurate, and to complete data that is incomplete, including by providing a supplementary statement. Where we have disclosed the data to others, we tell them about the correction unless that proves impossible or requires disproportionate effort.

4. Right to erasure (Article 17)

You may ask us to delete personal data about you where it is no longer needed for the purpose it was collected for, where you withdraw the consent the processing rests on and there is no other basis for it, where you object successfully under Article 21, or where the data has been processed unlawfully. The right is not absolute: we may keep data we are legally required to retain, or that we need in order to establish, exercise, or defend legal claims, and we tell you when that is why.

5. Right to restriction of processing (Article 18)

You may ask us to pause processing rather than delete it, for example while we verify the accuracy of data you have contested, or while we consider an objection you have raised. While a restriction is in place we store the data but do not otherwise use it, except with your consent or for legal claims, and we tell you before the restriction is lifted.

6. Right to data portability (Article 20)

Where we process personal data you provided to us by automated means, on the basis of your consent or of a contract with you, you may ask to receive it in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where that is technically feasible.

7. Right to object (Article 21)

Where we process personal data on the basis of our legitimate interests, you may object on grounds relating to your particular situation. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims. Where personal data is processed for direct marketing, you may object at any time and we stop without exception.

8. Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time, and it must be as easy to withdraw as it was to give. Withdrawal does not affect the lawfulness of processing carried out before it, and it does not affect processing that rests on a different basis, such as a contract or a legal obligation.

9. Rights under French law

In France the GDPR is supplemented by Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended. It carries the same rights and adds a few of its own, including the right to give directives on what becomes of your personal data after your death.

We handle requests made under that law through the same channel, and to the same standard, as requests made under the GDPR. Where the two regimes both apply to a request, we apply whichever gives you the stronger protection.

10. How to exercise your rights

Write to info@lensx.tech, or by post to Gruther, 19 boulevard Malesherbes, 75008 Paris, France. Tell us which right you wish to exercise and, if you can, which data or which service the request concerns. We may ask for information sufficient to verify your identity, so that we do not disclose personal data to the wrong person. There is no fee, unless a request is manifestly unfounded or excessive.

If your personal data is processed in LensX on behalf of one of our customers, contact that organization first. In that situation the customer is the controller, it decides what is processed and why, and it is the party that can act on your request. We are its processor. If you write to us, we will refer you to the customer, and we assist our customers in responding to the requests they receive.

11. Response times

We respond within one month of receiving your request. Where a request is complex, or where you have made several, we may extend that period by up to two further months. If we do, we tell you within the first month and explain why. If we cannot act on a request, we tell you why and inform you of your right to complain to a supervisory authority and to seek a judicial remedy.

12. Complaints

We would rather resolve a concern with you directly, so please raise it with us first. You also have the right to complain to a supervisory authority, and doing so does not affect any other remedy available to you.

If you are in the European Economic Area, you may complain to the supervisory authority of the member state where you live, where you work, or where the alleged infringement took place. Our own lead supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris.

13. Contact

To reach us about anything on this page:

• By email: info@lensx.tech
• By post: Gruther, 19 boulevard Malesherbes, 75008 Paris, France