←Back to Legal

Data Subject Rights (DSR) Policy

Last Updated: August 1, 2025

This Data Subject Rights ("DSR") Policy explains how individuals can exercise their rights under applicable data protection laws with respect to their personal data processed by Blend Lab FZE ("Bunud", "we", "us", or "our"). This Policy is supplemental to the Bunud Privacy Policy.

1. Who This Policy Applies To

This DSR Policy applies to all individuals whose personal data is processed by Bunud, including users of www.bunud.ai, firms.bunud.ai, and any associated services.

2. Available Rights

Depending on your jurisdiction and applicable data protection laws (e.g., UAE DP Law, GDPR, CCPA), you may have the following rights:

  • Right to Access: Request a copy of your personal data we hold.

  • Right to Rectification: Request correction of inaccurate or incomplete personal data.

  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to retention exceptions.

  • Right to Restrict Processing: Request temporary or permanent restriction of processing.

  • Right to Data Portability: Request your data in a machine-readable format.

  • Right to Object: Object to processing based on our legitimate interests or direct marketing.

  • Right to Withdraw Consent: Withdraw previously given consent, where applicable.

  • Right Not to be Subject to Automated Decision-Making: Request human intervention in certain automated processes.

3. Submitting a DSR Request

To exercise any of your rights, please contact us at:

Email: privacy@bunud.ai
Subject line: "DSR Request - [Your Name]"

In your request, please include:

  • Your full name and contact email.

  • Description of the right exercise you wish.

  • Any identifiers (e.g., user ID or account email).

We may request additional information to verify your identity and ensure the security of your data.

4. Response Timeline

We aim to respond to all verified DSR requests within 30 days. In some cases, this may be extended by an additional 30 days for complex requests, in which case we will inform you of the extension.

5. When Data May Not Be Available

In certain cases, we may be unable to fulfill a request because:

  • The personal data has already been deleted under our data retention policies.

  • The requested data was never collected or stored (e.g., AI chat sessions not retained).

  • Legal, contractual, or regulatory obligations require us to retain some data.

In such cases, we will clearly explain the reason for our inability to fulfill the request.

6. Data Security Measures

We take reasonable measures to ensure all personal data is protected against unauthorized access, disclosure, alteration, or loss. This includes identity verification before releasing any personal data.

7. Appeals & Complaints

If you are dissatisfied with our response, you may:

  • Contact our privacy team again to clarify or challenge our response.

  • Lodge a complaint with the relevant data protection authority in your jurisdiction.

8. Updates to This Policy

We may revise this DSR Policy from time to time. The most recent version will always be available at www.bunud.ai/legal.