Data rights

Last updated: March 2026.

Alpha Base OS Ltd ("Sunzu") is committed to upholding your rights over personal data we process about you. This policy explains how to exercise each right and what to expect from us.

1. Right of access (Subject Access Request)

You may request a copy of the personal data we hold about you, together with information about how it is processed, the legal basis for processing, and how long we intend to retain it. We will provide this in a structured, legible format within one calendar month of receiving your request. Where a request is complex or numerous, we may extend this period by a further two months, notifying you within the first month.

2. Right to rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will act on verified rectification requests without undue delay, and notify any third parties with whom the data has been shared where technically feasible.

3. Right to erasure ("right to be forgotten")

You may request deletion of your personal data where:

• The data is no longer necessary for the purpose for which it was collected.
• You withdraw consent and there is no other legal basis for processing.
• You object to processing and there are no overriding legitimate grounds.
• The data has been unlawfully processed.
• Erasure is required to comply with a legal obligation.

Erasure may not be possible where we are required by law to retain data, or where the data is necessary to establish, exercise, or defend legal claims.

4. Right to restriction of processing

You may request that we restrict processing of your data in certain circumstances: while accuracy is contested, where processing is unlawful but you prefer restriction to erasure, where we no longer need the data but you require it for legal claims, or where you have objected and we are assessing whether our legitimate grounds override your rights.

5. Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and transmit it to another data controller. This right applies to data you have provided directly to us.

6. Right to object

You have the right to object at any time to processing of your personal data based on legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims. You may object to direct marketing at any time with no need to provide justification; we will stop immediately.

7. Withdrawal of consent

Where processing is based on your consent (including marketing communications and non-essential cookies), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, we will cease the relevant processing without undue delay. To withdraw consent to marketing, use the unsubscribe link in any marketing email or contact hello@sunzu.ai. To withdraw cookie consent, adjust your browser settings or our cookie preference controls.

8. Right not to be sold

Sunzu does not sell personal data to third parties for advertising or commercial purposes. If you are a California resident, you have additional rights under the CCPA/CPRA, including the right to opt out of the sale or sharing of personal information. As we do not sell or share personal data in the sense defined by CCPA, no opt-out action is required, but you may confirm this position by contacting us.

9. Social-media suppression

Where your data has been used in active social-media advertising campaigns (for example, custom audiences on Meta or LinkedIn), suppression from live campaigns may take longer than direct deletions from our systems, as these depend on third-party platform processing cycles. We will initiate suppression requests immediately upon receiving your confirmed request.

10. How to exercise your rights

Submit a request to hello@sunzu.ai with the subject line "Data Rights Request." We may ask you to verify your identity before proceeding. We do not charge for exercising your rights unless requests are manifestly unfounded or excessive.

11. Complaints and escalation

If you are dissatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or with the supervisory authority in your country of residence.