Do Not Sell or Share My Personal Information
AqNova Marketplace Policies & Disclosures
AQNOVA MARKETPLACE
Global Legal Footer Framework
Comprehensive Compliance & Platform Governance Reference
DATA SUBJECT RIGHTS REQUEST PORTAL
Global Privacy Rights Framework — Exercising Your Rights Across All Jurisdictions
Effective Date: April 7, 2026 | Version 1.0 | Arivon Holding Corporation
| Regulatory Frameworks — Privacy Rights & Opt-Out Obligations United States (California): CCPA (Cal. Civ. Code § 1798.100 et seq.); CPRA (Prop. 24, 2020) Right to opt out of sale (§ 1798.120); sharing for CCBA (§ 1798.135) Right to limit use of sensitive PI; GPC signal obligation US — Other States: Colorado CPA (C.R.S. § 6-1-1301); Virginia CDPA; Connecticut CTDPA Texas TDPSA; Florida FDBR; Oregon OCPA; Montana MCDPA; Iowa ICDPA Nevada SB 220; Indiana IDPA; Tennessee TIPA; Delaware DPDPA European Union: GDPR (2016/679) Arts. 12–22 — Full data subject rights suite DSA (EU 2022/2065) — Right to contest content moderation decisions United Kingdom: UK GDPR Arts. 12–22; Data Protection Act 2018 Schedule 2 Canada: PIPEDA Principle 9 (Access); Quebec Law 25 (Bill 64) — Rights Brazil: LGPD Arts. 17–22 — Titular rights; ANPD enforcement Nigeria: NDPA 2023 Sections 34–42 — Data subject rights Kenya: Data Protection Act 2019 Sections 26–35 Ghana: Data Protection Act 2012 (Act 843) Part IV South Africa: POPIA Sections 23–25 — Data subject rights Egypt: PDPL 151/2020 — Data subject rights India: DPDPA 2023 Sections 11–13 — Data principal rights Australia: Privacy Act 1988 APPs 12–13 (Access & Correction) Singapore: PDPA 2012 Part V (Access & Correction rights) Japan: APPI Chapter IV (Disclosure, Correction, Utilization cessation) South Korea: PIPA Chapter V — Data subject rights China: PIPL 2021 Chapter IV — Personal information rights Colombia / Chile / Argentina / Mexico: National data protection acts — ARCO rights |
|---|
| ⚠ IMPORTANT LEGAL NOTICE THIS DOCUMENT COVERS TWO RELATED SECTIONS: SECTION 3.3: THE RIGHT TO OPT OUT OF THE SALE OR SHARING OF YOUR PERSONAL INFORMATION (PRIMARILY CALIFORNIA CCPA/CPRA AND EQUIVALENT US STATE LAWS) SECTION 3.4: THE GLOBAL DATA SUBJECT RIGHTS REQUEST PORTAL — ALL JURISDICTIONS YOUR RIGHTS CANNOT BE DIMINISHED BY AQNOVA'S POLICIES. WHERE APPLICABLE LAW PROVIDES GREATER RIGHTS THAN THOSE DESCRIBED HERE, THOSE RIGHTS APPLY. AQNOVA WILL NEVER PENALIZE YOU FOR EXERCISING ANY PRIVACY RIGHT. |
|---|
| Quick Navigation — Your Rights at a Glance OPT OUT OF SALE/SHARING (California): [aqnova.co/privacy/do-not-sell] or use the link in the Platform footer SUBMIT A RIGHTS REQUEST (All Jurisdictions): [aqnova.co/privacy/rights] or email: privacy@aqnova.co SECTION 3.3: Do Not Sell or Share — page 3 SECTION 3.4: Data Subject Rights Portal — page 12 RESPONSE TIMELINE MATRIX — page 23 SUPERVISORY AUTHORITY DIRECTORY — page 28 |
|---|
A. California Legal Framework
The California Consumer Privacy Act (CCPA, Cal. Civ. Code § 1798.100 et seq.), as significantly amended by the California Privacy Rights Act (CPRA, Proposition 24), grants California residents a suite of enforceable privacy rights, two of which relate specifically to the commercial use of personal information by businesses:
The Right to Opt Out of Sale: the right to direct a business not to sell personal information about the consumer to third parties (CCPA § 1798.120; CPRA amendment).
The Right to Opt Out of Sharing: introduced by CPRA, the right to direct a business not to share personal information with third parties for cross-context behavioral advertising (CCBA) purposes, regardless of whether monetary consideration is exchanged (Cal. Civ. Code § 1798.135).
The CPRA created the California Privacy Protection Agency (CPPA), which assumed rulemaking and enforcement authority from the California Attorney General on July 1, 2023. AqNova's compliance with the CPRA is overseen by the CPPA's enforcement framework.
B. AqNova's Position — Does AqNova Sell Personal Information?
| AqNova's Position on Sale & Sharing of Personal Information AqNova does NOT sell personal information as defined under CCPA § 1798.140(ad). AqNova does NOT share personal information for cross-context behavioral advertising as defined under CCPA § 1798.140(ah) and CPRA. AqNova's business model is not advertising-based. We do not receive consideration for disclosing your personal information to third parties for their own commercial use. HOWEVER, because the CCPA/CPRA definitions of 'sale' and 'sharing' are intentionally broad and may encompass certain technical data flows — including the transmission of pseudonymous identifiers to advertising measurement platforms (e.g., Meta Pixel, Google Ads) for our own campaign measurement purposes — AqNova provides the Do Not Sell or Share opt-out mechanism as a precautionary compliance measure, consistent with the CPPA's guidance on marketing measurement technologies. This means: even if you do not opt out, AqNova is not 'selling' your data in the traditional sense. But if you prefer that AqNova not transmit any identifiers to third-party advertising platforms, you can opt out completely and we will honor that. |
|---|
A. Opt-Out Methods
California residents — and all other US state residents with equivalent opt-out rights — may opt out of the sale or sharing of their personal information through any of the following methods:
| OPT-OUT METHODS — ALL AVAILABLE AT ANY TIME METHOD 1 — ONLINE FORM (Preferred): URL: [aqnova.co/privacy/do-not-sell] Description: Submit a Do Not Sell or Share request through our dedicated online form. No account required. The form is accessible to all visitors. Response: Confirmation email within 24 hours; opt-out effective within 15 business days. METHOD 2 — FOOTER LINK: Every page of the AqNova Platform displays a 'Do Not Sell or Share My Personal Information' link in the footer, as required by CCPA § 1798.135(a)(1). Clicking this link takes you directly to the opt-out form. METHOD 3 — GLOBAL PRIVACY CONTROL (GPC): AqNova honors the GPC browser signal (navigator.globalPrivacyControl) as an automatic opt-out from sale and sharing, as required by CPRA and Colorado CPA. No form submission needed — the signal is detected at page load and immediately suppresses all marketing measurement sharing. METHOD 4 — ACCOUNT SETTINGS (Logged-In Users): Navigate to: Account > Privacy Settings > Do Not Sell or Share Toggle off 'Allow sharing for campaign measurement.' Preference saved immediately and synchronized across devices. METHOD 5 — EMAIL REQUEST: Email: privacy@aqnova.co Subject line: 'Do Not Sell or Share — [State Abbreviation]' Include: name and email address associated with your account (if any). Response: Confirmation within 24 hours; opt-out effective within 15 business days. METHOD 6 — AUTHORIZED AGENT: A California resident may designate an authorized agent to submit an opt-out request on their behalf. The agent must provide written authorization signed by the consumer. See Section 3.3.6 — Authorized Agent Procedures. |
|---|
B. Opt-Out Form — Required Fields
The Do Not Sell or Share opt-out form at [aqnova.co/privacy/do-not-sell] collects only the minimum information necessary to process the request and verify your identity:
Email address (required — used to identify your account or prior data interactions and to send opt-out confirmation).
Name (optional — assists in identification; not required for opt-out processing).
State of residence (required — determines which opt-out rights apply to you).
Account status (checkbox: registered account holder / unregistered visitor).
Opt-out scope (checkboxes: 'Opt out of sale' / 'Opt out of sharing for advertising' / 'Both').
Additional instructions (optional free-text field for any specific context or scope).
AqNova does not require you to create an account to submit an opt-out request and will not use the information collected in the opt-out form for any purpose other than processing the request and maintaining the required opt-out record.
C. What Happens After You Opt Out
Upon processing your opt-out request, AqNova will:
Within 15 business days of receiving the request: suppress all sale and sharing of your personal information for covered purposes. Specifically, all Category 4 marketing cookies and measurement pixel scripts will be deactivated for your browser session; your identifier will be excluded from server-side event API transmissions to advertising platforms.
Send a confirmation email within 24 hours of receiving the request, and a second confirmation within 15 business days confirming that the opt-out has been implemented.
Maintain your opt-out preference for a minimum of 12 months without re-prompting you to accept marketing sharing.
After 12 months: AqNova may ask if you wish to re-authorize sharing. This re-prompting will be voluntary; you are not required to respond; silence constitutes continued opt-out.
For logged-in users: the opt-out preference is recorded in your account settings and applied across all devices where you are logged in.
For non-logged-in visitors: the opt-out is recorded via a browser-level opt-out cookie and through the aqnova.co server-side do-not-share flag associated with your IP address. AqNova recommends logging in to ensure the opt-out persists across devices.
3.3.4 Right to Limit Use & Disclosure of Sensitive Personal Information (CPRA)
The CPRA introduced a new right — the right to limit the use and disclosure of sensitive personal information (SPI) — that is distinct from the right to opt out of sale and sharing. California residents have the right to direct AqNova to limit its use of SPI to uses that are necessary to perform the services reasonably expected by an average consumer, and to disclosures to service providers for that purpose.
| Sensitive Personal Information — AqNova's Practices California defines 'sensitive personal information' (SPI) to include: — Social Security Number and government ID numbers — Financial account data (account numbers, card numbers) — Precise geolocation data — Racial or ethnic origin, religious or philosophical beliefs, union membership — Contents of mail, email, and text messages not directed to the business — Genetic data — Biometric information (for purpose of unique identification) — Health, sex life, and sexual orientation AQNOVA'S POSITION ON EACH: SSN / Government ID: Vendor KYC only; used exclusively for identity verification. Never sold, shared, or used for advertising. Financial account data: Processed by PCI-DSS certified payment processors. Never used beyond payment processing and fraud prevention. Precise geolocation: NOT collected. AqNova uses country-level IP geolocation only. Racial/ethnic origin: NOT collected intentionally. No inference made. Mail/email contents: Viewed only for customer support; never shared or sold. Genetic / biometric: NOT collected for general Platform use. Health / sex life: NOT collected. Purchase history in health categories is not used for SPI-category profiling. RESULT: AqNova does not use SPI for purposes beyond service provision. The CPRA 'Limit Use' right is honored as a matter of standard practice — you do not need to submit a separate request unless you believe a specific SPI use requires it. To submit a Limit Use request: [aqnova.co/privacy/rights] or privacy@aqnova.co |
|---|
3.3.5 US State Privacy Law — Opt-Out Rights Beyond California
Numerous US states beyond California have enacted comprehensive consumer privacy laws that include opt-out rights similar to, but not identical to, California's CCPA/CPRA. AqNova honors opt-out rights under all enacted state privacy laws. The following table summarizes the opt-out rights available by state and AqNova's implementation:
| State / Law | Opt-Out Rights & AqNova's Implementation |
|---|---|
| Colorado — CPA (C.R.S. § 6-1-1301, effective July 1, 2023) | Right to opt out of: (1) targeted advertising; (2) sale of personal data; (3) profiling in furtherance of legal or similarly significant decisions. Universal Opt-Out Mechanism (UOM) required: GPC is the designated UOM. AqNova honors GPC and provides the Do Not Sell link. Opt-out honored within 15 business days. |
| Virginia — CDPA (Va. Code § 59.1-571, effective Jan 1, 2023) | Right to opt out of: (1) targeted advertising; (2) sale of personal data; (3) profiling for decisions with legal/significant effects. No UOM required (GPC honored voluntarily by AqNova). Opt-out via [aqnova.co/privacy/do-not-sell] or privacy@aqnova.co. |
| Connecticut — CTDPA (P.A. 22-15, effective July 1, 2023) | Right to opt out of: (1) targeted advertising; (2) sale of personal data; (3) profiling with significant effects. UOM required (from Jan 1, 2025): GPC honored. Appeal right for refused requests within 60 days. |
| Texas — TDPSA (effective July 1, 2024) | Right to opt out of: (1) targeted advertising; (2) sale of personal data; (3) profiling for significant decisions. UOM must be honored. Opt-out via dedicated link and GPC. |
| Florida — FDBR (effective July 1, 2024) | Applies to controllers with $1B+ revenue and specific data models. Right to opt out of targeted advertising and sale. AqNova honors this right through its standard opt-out mechanism. |
| Oregon — OCPA (effective July 1, 2024) | Right to opt out of targeted advertising, sale, and automated decision profiling. GPC honored as UOM. Opt-out via standard AqNova mechanism. |
| Montana — MCDPA (effective Oct 1, 2024) | Right to opt out of targeted advertising, sale, and profiling. GPC honored. Standard opt-out mechanism applies. |
| Indiana — IDPA (effective Jan 1, 2026) | Right to opt out of targeted advertising, sale, and certain profiling. Standard opt-out mechanism applies. |
| Tennessee — TIPA (effective July 1, 2025) | Right to opt out of targeted advertising, sale, and profiling. GPC honored. Standard opt-out mechanism applies. |
| Iowa — ICDPA (effective Jan 1, 2025) | Right to opt out of sale of sensitive data and targeted advertising. No right to opt out of non-sensitive data sale. AqNova applies the standard opt-out to all categories for simplicity. |
| Delaware — DPDPA (effective Jan 1, 2025) | Broad opt-out rights including targeted advertising, sale, and profiling. UOM honored. Standard mechanism applies. |
| Nevada — SB 220 / SB 260 | Right to opt out of sale of covered information. Opt-out via designated email: privacy@aqnova.co [Subject: Nevada Opt-Out]. |
| All other US states (no specific law enacted) | AqNova extends its Do Not Sell or Share opt-out to all US residents regardless of state, as a matter of AqNova's highest-common-denominator privacy standard. |
3.3.7 Non-Discrimination — Exercising Your Opt-Out Right
AqNova will not discriminate against any California resident (or resident of any other state) for exercising their right to opt out of the sale or sharing of their personal information. Specifically, AqNova will NOT, as a result of your opt-out:
Deny you goods or services available on the Platform.
Charge you a higher price for goods or services.
Provide you a lower quality of goods or services.
Suggest that you will receive a lower quality of service.
Reduce the effectiveness of AqNova's Buyer Protection Program.
Restrict access to any account features, order history, or Platform functionality.
Terminate your account or disadvantage you in any dispute or claim process.
Note on financial incentives: AqNova does not currently offer financial incentives (discounts, bonuses, or preferred pricing) in exchange for the collection, sale, or sharing of personal information. If AqNova introduces any such program in the future, it will provide adequate disclosure and obtain explicit opt-in consent, consistent with CCPA § 1798.125.
3.3.8 Global Equivalent Opt-Out Rights — Beyond US Law
The right to opt out of certain types of data processing — equivalent in concept to the CCPA/CPRA opt-out right — exists in various forms under privacy frameworks worldwide. AqNova honors these rights for all users globally through its unified rights portal and the opt-out mechanisms described in this section:
| Jurisdiction / Right | Equivalent Opt-Out / Objection Right & AqNova's Response |
|---|---|
| EU / UK — GDPR Art. 21: Right to Object | EU and UK users have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f)) and to processing for direct marketing. The right to object to direct marketing is unconditional. AqNova ceases processing immediately upon receipt of an objection to direct marketing and suppresses all marketing cookies. Rights portal at [aqnova.co/privacy/rights]. |
| Canada — PIPEDA Principle 3 (Consent) | Canadians may withdraw consent to the use of their personal information for marketing purposes at any time. Withdrawal is processed via: unsubscribe links; account settings; or privacy@aqnova.co. Quebec users: additional rights under Law 25 including the right to de-indexation where applicable. |
| Brazil — LGPD Art. 18(IV): Anonymization, Blocking, Deletion | Brazilian data subjects have the right to request anonymization, blocking, or deletion of unnecessary or excessive personal data, including data processed for marketing. Exercised via the rights portal or privacy@aqnova.co [Subject: LGPD — Brazil]. Response within 15 days. |
| South Africa — POPIA § 11(3): Objection to Processing | South African data subjects have the right to object to the processing of their personal information for purposes of direct marketing by means of unsolicited electronic communications. AqNova honors such objections immediately. |
| South Korea — PIPA Art. 37: Right to Restrict Processing | South Korean data subjects may request restriction of processing where accuracy is disputed or the processing violates applicable law. AqNova honors restriction requests within 10 business days. |
| Japan — APPI Art. 30: Cessation of Use | Japanese individuals have the right to request cessation of use, deletion, or cessation of third-party provision of personal information where the processing violates the APPI. AqNova processes such requests within 2 months as prescribed by the APPI. |
| China — PIPL Art. 44: Right to Object & Withdrawal | Chinese data subjects have the right to withdraw consent and to object to certain processing. Withdrawal of consent does not affect the lawfulness of prior processing. AqNova processes PIPL withdrawal and objection requests within 15 days. |
| India — DPDPA 2023 § 13: Right to Withdraw Consent | Indian data principals have the right to withdraw consent for any processing based on consent. Withdrawal is honored promptly. AqNova's Grievance Officer (grievance-india@aqnova.co) handles India-specific requests. |
| Australia — APP 3.3: Opt Out of Direct Marketing | Australian individuals have the right under APP 7.2 to opt out of receiving direct marketing communications from AqNova. AqNova provides unsubscribe mechanisms in all marketing emails and in account settings. |
3.4.1 Portal Overview — Exercising Your Rights Globally
AqNova's Data Subject Rights Request Portal is a unified, accessible, multilingual interface through which any individual — regardless of jurisdiction — can exercise their privacy rights in relation to their personal data held by AqNova. The Portal is designed to make the exercise of rights straightforward, transparent, and free of charge, consistent with AqNova's highest-common-denominator privacy standard and the requirements of applicable law in every jurisdiction where AqNova operates.
| Portal Access Points PRIMARY: Online Portal: [aqnova.co/privacy/rights] Available 24/7; 20+ language interfaces; no account required Response tracking dashboard for logged-in users EMAIL: privacy@aqnova.co Subject line: '[Rights Request Type] — [Your Country]' Response within 5 Business Days acknowledging receipt POSTAL: Data Protection Officer Arivon Holding Corporation 2571 Saturn Avenue, Unit #265, Huntington Park, CA 90255, USA INDIA: Grievance Officer: grievance-india@aqnova.co DPDPA 2023 — Acknowledged within 24 hours; resolved within 15 days KEY RIGHTS COVERED: Access | Correction | Erasure | Portability | Restriction Objection | Opt-Out | Withdraw Consent | Human Review of AI Non-Discrimination | Lodge Complaint with Supervisory Authority |
|---|
A. What This Right Covers
The right of access (also called the right to know) entitles you to receive confirmation of whether AqNova processes your personal data and, if so, to obtain:
A copy of the personal data AqNova holds about you, in the categories listed in the Privacy Policy (Section 3.1.2).
The purposes for which your data is processed.
The categories of recipients with whom your data has been shared.
The retention period applicable to each category of your data.
Information about the source of your data (where collected from a source other than you directly).
Whether automated decision-making is applied to your data and, if so, meaningful information about the logic involved.
Your rights in relation to the data, including rights to correction, erasure, restriction, and objection.
B. How to Exercise
Submit a Right of Access request through the Portal at [aqnova.co/privacy/rights], selecting 'Access / Know' as the request type. Alternatively, email privacy@aqnova.co with the subject line 'Access Request — [Your Country].' AqNova will verify your identity before releasing personal data (see Section 3.4.11 — Identity Verification).
C. What You Will Receive
AqNova provides access responses in a structured, machine-readable format (JSON or CSV, with a human-readable HTML summary), including all personal data categories applicable to your account type (Buyer, Vendor, or Visitor). The response is delivered securely — either through the Portal's secure download feature (for logged-in users) or via encrypted email attachment. AqNova does not provide access to third-party data that is not AqNova's to disclose (e.g., Vendor financial records not related to your account).
A. What This Right Covers
You have the right to request that AqNova correct any personal data it holds about you that is inaccurate, incomplete, or outdated. This right applies to all categories of personal data, including identity data, contact data, financial data, and transaction records, subject to the limitations below.
B. Self-Service Correction — Account Settings
Most personal data can be corrected directly through your AqNova account settings without submitting a formal rights request:
Name, email address, phone number, and delivery/billing address: editable in Account > Personal Information.
Marketing preferences and communication channel settings: editable in Account > Communication Preferences.
Sustainability interest profile: editable in Account > Sustainability Preferences.
Vendor business information (business name, address, banking details): editable in Vendor Dashboard > Store Settings.
C. Formal Correction Requests
For data that cannot be self-corrected (e.g., transaction records, KYC-verified information, tax records), submit a formal correction request through the Portal. You must provide:
Identification of the inaccurate data with sufficient specificity.
The correct information you wish AqNova to substitute.
Supporting documentation (where the correction relates to identity-verified data such as legal name or business registration details, documentation of the correct information is required).
AqNova will acknowledge correction requests within 5 Business Days and complete the correction within the applicable response period (see Section 3.4.10 — Response Timelines). Where AqNova disagrees with your claimed correction (e.g., if the data is accurate as recorded), it will explain its position and provide you with information about your right to escalate to the applicable supervisory authority.
A. Grounds for Erasure
You have the right to request deletion of your personal data in the following circumstances:
The personal data is no longer necessary for the purpose for which it was collected or processed.
You withdraw consent and no other legal basis applies to the processing.
You object to processing based on legitimate interests and AqNova has no overriding compelling legitimate grounds.
You object to processing for direct marketing purposes (always upheld without exception).
The personal data has been unlawfully processed.
The personal data must be erased to comply with a legal obligation.
The personal data was collected in relation to an offer of information society services to a child under applicable age thresholds.
B. Exceptions — When Erasure Cannot Be Completed
AqNova cannot erase personal data in the following circumstances, and will explain which exception applies if it cannot fulfill an erasure request in full:
Legal retention obligations: personal data that must be retained under applicable law — including tax records (7–10 years), AML/KYC records (5 years), financial transaction records (7 years), and active legal proceedings data — cannot be deleted until the applicable retention period expires.
Ongoing legal claims: personal data relevant to an active dispute, litigation, chargeback investigation, or regulatory proceeding cannot be deleted until the matter is fully resolved.
Public interest or research: data processed for certain public interest purposes or legitimate research may be subject to limited erasure exceptions under applicable law.
Freedom of expression and information: where erasure would impair another individual's right to freedom of expression or the right to access information.
| What Happens When You Request Erasure 1. AqNova acknowledges your erasure request within 5 Business Days. 2. AqNova assesses whether any retention exceptions apply to your data. 3. AqNova notifies you of: (a) data that can be erased and the timeline for erasure; (b) data that cannot be erased, with the specific retention exception and the expected date on which the exception will cease to apply. 4. AqNova completes erasure of deletable data within the applicable response period. 5. Erasure means: data deleted from live systems; deletion propagated to backups within 90 days; or anonymization where full deletion is technically infeasible. 6. AqNova notifies third parties who have received your data of the erasure request where technically feasible and not disproportionately burdensome (GDPR Art. 17(2)). 7. A confirmation of erasure is sent to your verified email address. Account Closure: Submitting an erasure request typically results in account closure. Outstanding orders will be fulfilled before account closure. Outstanding payouts (for Vendors) will be settled within the standard payout cycle before closure. |
|---|
A. When Restriction Applies
You have the right to request that AqNova restricts (pauses) the processing of your personal data in the following circumstances:
You contest the accuracy of the personal data: processing is restricted while AqNova verifies the accuracy of the data.
Processing is unlawful and you prefer restriction over erasure.
AqNova no longer needs the personal data but you require it for the establishment, exercise, or defense of legal claims.
You have objected to processing based on legitimate interests, and AqNova's assessment of the objection is pending.
B. Effect of Restriction
During a restriction period, AqNova will store your personal data but will not process it for any other purpose without your consent, except for storage; to establish, exercise, or defend legal claims; to protect the rights of another natural or legal person; or for important public interest reasons. AqNova will notify you before lifting a restriction.
A. Scope of the Portability Right
The right to data portability entitles you to receive a copy of the personal data you have provided to AqNova in a structured, commonly used, machine-readable format — and to have that data transmitted directly to another controller where technically feasible. Portability applies where processing is based on consent or on the performance of a contract, and is carried out by automated means.
The following personal data categories are in scope for portability requests:
Account and identity data you provided at registration (name, email, contact details, preferences).
Transaction history (orders placed, products purchased, returns and refunds).
Communication preferences and consent records.
Sustainability profile data and interest preferences you have provided or confirmed.
Review content you have authored.
B. How to Request Portability
Submit a portability request through the Portal selecting 'Data Portability.' Alternatively, for most data, use the self-service data export tool in Account > Privacy Settings > Download My Data. The self-service tool generates a downloadable archive (ZIP file) containing your data in JSON and CSV formats within 24 hours of the request. For requests involving data that cannot be exported through the self-service tool, a manual portability response is provided within the applicable response period.
A. Object to Direct Marketing — Unconditional
You have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time. AqNova will stop processing your data for marketing purposes immediately upon receipt of your objection — no balancing test or assessment is required. All marketing communications will cease within 2 Business Days of your objection being confirmed.
You may exercise this right through: the unsubscribe link in any AqNova marketing email (immediate effect on that communication channel); Account > Communication Preferences > Opt Out of All Marketing; or privacy@aqnova.co [Subject: Object to Marketing].
B. Object to Legitimate Interests Processing
You have the right to object to processing based on AqNova's legitimate interests (GDPR Art. 6(1)(f)) on grounds relating to your particular situation. You must provide the grounds for your objection — i.e., explain why, in your specific situation, AqNova's processing impacts your rights and interests in a way that outweighs AqNova's legitimate purpose.
Upon receipt of a legitimate interests objection, AqNova will: (a) acknowledge within 5 Business Days; (b) conduct a reassessment of the legitimate interests balance in light of the grounds you have provided; (c) either cease the objected-to processing, or demonstrate compelling legitimate grounds that override your interests; (d) notify you of the outcome within the applicable response period.
C. Object to Automated Decision-Making & Profiling
Where AqNova's automated systems produce decisions with significant effects on you (e.g., account suspension decisions, fraud-related payment holds), you have the right to object to the decision and to request human review. See Section 3.4.9 — Rights Related to Automated Decisions.
3.4.8 Right to Withdraw Consent
Where AqNova processes your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal. The following consent categories can be withdrawn:
| Consent Type | How to Withdraw & Effect of Withdrawal |
|---|---|
| Marketing email communications | Click the unsubscribe link in any marketing email, or navigate to Account > Communication Preferences > Unsubscribe from All. Effect: marketing emails cease within 2 Business Days. Transactional emails (orders, security) continue. |
| SMS/push notification marketing | Account > Communication Preferences > SMS/Push Notifications > Opt Out. Or contact privacy@aqnova.co. Effect: SMS/push marketing ceases immediately. |
| Analytics cookies (Category 3) | Cookie Preference Center ([aqnova.co/privacy/cookies]) > Toggle off Analytics. Effect: Category 3 cookies invalidated immediately; analytics data collection stops. |
| Marketing cookies (Category 4) | Cookie Preference Center > Toggle off Marketing. Or submit Do Not Sell/Share request. Effect: Category 4 cookies invalidated; marketing sharing stops immediately. |
| Sustainability profiling / personalization | Account > Privacy Settings > Personalization Preferences > Disable Personalized Recommendations. Effect: sustainability profile no longer used for recommendations; generic recommendations displayed. |
| KYC biometric / liveness check data (Vendors) | Contact privacy@aqnova.co. Note: withdrawal of consent for KYC biometric data may affect your ability to maintain your Vendor account if KYC re-verification is required. AqNova will discuss alternatives before processing withdrawal. |
| All consents simultaneously | Account > Privacy Settings > Withdraw All Consents, or privacy@aqnova.co [Subject: Withdraw All Consents]. Effect: all consent-based processing ceases; note that contract-based and legal obligation processing continues. |
A. Right Not to Be Subject to Solely Automated Decisions
Under GDPR Article 22 and equivalent provisions, AqNova does not make binding automated decisions with significant legal or similarly significant effects on individuals without a human review stage. AqNova's automated systems generate recommendations and flags; human reviewers make the final determination on all consequential outcomes (permanent account bans, denial of Vendor applications, significant fraud-related holds).
B. Right to Explanation
Where an automated system has produced a decision or recommendation that has affected your account — such as a temporary payment hold, account restriction, or listing removal — you have the right to request a meaningful explanation of: (a) the principal factors that contributed to the automated output; (b) the significance and expected impact of those factors; and (c) the outcome and what you can do to address it.
To request an explanation: email privacy@aqnova.co [Subject: Automated Decision Explanation — [Account Action Date]]. AqNova will provide a plain-language explanation within the applicable response period.
C. Right to Human Review
You have the right to request human review of any automated decision that has significantly affected you. To exercise this right: email privacy@aqnova.co [Subject: Request Human Review — [Account Action Date]] or submit through the Portal. AqNova will: (a) acknowledge within 2 Business Days; (b) assign a human reviewer not involved in the original automated decision; (c) complete the review and notify you of the outcome within 10 Business Days (20 Business Days for complex cases involving multiple transactions or accounts).
D. Right to Contest
If you disagree with the outcome of a human review, you have the right to contest AqNova's decision by providing additional information, documentation, or arguments. Contested reviews are escalated to AqNova's senior Trust & Safety team. If you remain dissatisfied after the contested review, you have the right to lodge a complaint with the applicable supervisory authority (see Section 3.4.12).
3.4.10 Response Timelines — Global Statutory Compliance Matrix
AqNova is committed to responding to all data subject rights requests within the statutory timeframes applicable to each jurisdiction. The following matrix sets out the legally mandated response periods and AqNova's operational commitments:
| Jurisdiction / Framework | Initial Acknowledgment | Full Response Deadline | Extension Available? |
|---|---|---|---|
| EU — GDPR (Art. 12) | 5 Business Days (AqNova commitment) | 1 month (30 days) from receipt | Yes — up to 2 additional months for complex/numerous requests, with notice to requestor within the initial 1-month period. |
| UK — UK GDPR / DPA 2018 | 5 Business Days | 1 month (30 days) from receipt | Yes — up to 2 additional months with notice. |
| United States — California CCPA/CPRA | 10 days (statutory); AqNova: 5 Business Days | 45 days from receipt | Yes — up to 45 additional days (total 90 days) with notice to requestor. |
| US — Colorado CPA | 5 Business Days (AqNova commitment) | 45 days from receipt | Yes — up to 45 additional days with notice. Appeal response: 60 days from appeal submission. |
| US — Virginia CDPA | 5 Business Days | 45 days from receipt | Yes — up to 45 additional days with notice. Appeal response: 60 days. |
| US — Connecticut CTDPA | 5 Business Days | 45 days from receipt | Yes — up to 45 additional days. Appeal right within reasonable time after denial. |
| US — Other State Laws | 5 Business Days (AqNova commitment) | 45 days from receipt (AqNova standard for all US) | Yes — up to 45 additional days with notice. |
| Canada — PIPEDA (Principle 9) | 5 Business Days | 30 days from receipt | Yes — extensions with notice where request is large-scale, third-party consultation required, or information difficult to retrieve. |
| Canada — Quebec Law 25 | 5 Business Days | 30 days from receipt | Yes — up to 30 additional days with notice. Commission d'accès à l'information may be notified. |
| Brazil — LGPD (Art. 18) | 2 Business Days (acknowledgment) | 15 days from receipt | Limited — ANPD guidance permits extension only in exceptional circumstances with documented justification. |
| Nigeria — NDPA 2023 | 5 Business Days | 30 days from receipt | Yes — up to 30 additional days with notice to NDPC where required. |
| Kenya — DPA 2019 | 5 Business Days | 21 days from receipt | Yes — reasonable extension with notice. |
| South Africa — POPIA (§ 23–25) | 5 Business Days | 30 days from receipt | Yes — extendable by 30 days with notice where request is large-scale or third-party consultation required. |
| Ghana — DPA 2012 | 5 Business Days | 21 days from receipt | Yes — reasonable extension with notice. |
| India — DPDPA 2023 | 24 hours (acknowledgment) | 15 days from receipt | No extension currently prescribed. AqNova applies strict 15-day compliance for India. |
| India — IT Rules 2021 (Grievance) | 24 hours (acknowledgment) | 15 days for resolution | No extension. Grievance Officer: grievance-india@aqnova.co |
| Australia — Privacy Act (APP 12) | 5 Business Days | 30 days from receipt | Yes — reasonable extension with notice where request involves large volume of documents or third-party consultation. |
| Singapore — PDPA (s. 21) | 5 Business Days | 30 days from receipt | Yes — up to 30 additional days with notice and written explanation. |
| Japan — APPI (Art. 32) | 5 Business Days | 2 months (APPI Art. 32(2)) | Yes — up to 2 additional months with notice in exceptional circumstances. |
| South Korea — PIPA (Art. 35) | 5 Business Days | 10 days from receipt | Yes — up to 10 additional days with notice. |
| China — PIPL (Art. 47) | 5 Business Days | 15 days from receipt | No extension currently specified under PIPL. AqNova applies strict 15-day compliance for China. |
| Colombia — Ley 1581/2012 | 5 Business Days (acknowledgment) | 10 Business Days from receipt | Yes — up to 5 additional Business Days with notice. |
| Argentina — Ley 25,326 | 5 Business Days | 30 days from receipt | Yes — reasonable extension with notice. |
| AqNova Global Standard (all other jurisdictions) | 5 Business Days (acknowledgment) | 30 days from receipt | Yes — up to 30 additional days with written notice explaining the reason for extension. |
A. Extension Procedures
Where AqNova requires additional time to respond to a complex or voluminous request, it will send a written notice within the initial response period (before the deadline expires) specifying: (a) the reason for the extension; (b) the extended response date; and (c) any partial information it can provide in the interim. Extensions are used sparingly and only where genuinely necessary.
B. Free Responses & Excess Request Fees
All data subject rights requests are processed free of charge. AqNova reserves the right to charge a reasonable administrative fee, or to decline to act on a request, only where the request is manifestly unfounded or excessive — in particular where it is repetitive in nature. Before charging any fee or declining to act, AqNova will notify the requestor and explain the basis for this determination. The requestor may challenge the determination by escalating to the applicable supervisory authority.
3.4.11 Identity Verification — Protecting Your Data
AqNova verifies the identity of all rights requestors before disclosing personal data, completing erasure, or taking any other consequential action on a request. Identity verification protects you from fraudulent requests made in your name by third parties. AqNova's verification process is proportionate to the sensitivity and scope of the request.
A. Standard Verification
For most requests (access, correction, portability, restriction), verification is completed through one or more of the following:
Email verification: AqNova sends a verification link to the email address associated with the account. The requestor must click the link to confirm ownership of the email address.
Account authentication: for logged-in Portal submissions, AqNova verifies identity through the active authenticated session. No additional verification is required for standard requests.
Knowledge-based verification: for requests submitted by users who are unable to access their registered email (e.g., the address has changed), AqNova may ask the requestor to confirm specific account details (e.g., recent order reference, registered delivery address) as a secondary verification factor.
B. Enhanced Verification
For high-sensitivity requests (erasure of KYC-verified data, financial data correction, requests from unregistered visitors), AqNova may require:
Government ID verification: the requestor confirms their identity by providing a reference to a government-issued ID. AqNova does not retain a copy of the ID beyond the period needed for verification.
Video or liveness check: in exceptional circumstances where other verification methods are insufficient or where the data at stake is particularly sensitive.
AqNova will not use the information collected for verification purposes for any other purpose and will delete verification materials upon completion of the request.
C. Limits on Verification
AqNova will not: require more information than is necessary to verify identity; use the verification process as a barrier to delay or avoid responding to legitimate requests; require government ID for routine access requests from verified account holders; or charge a fee for identity verification.
A. AqNova's Internal Appeal Process
If AqNova refuses a rights request in whole or in part, you have the right to appeal AqNova's decision. Appeals must be submitted within 30 days of receiving AqNova's refusal notice (or within any other appeal period prescribed by applicable law — e.g., Virginia CDPA: any reasonable time; Colorado CPA: no specific period; Connecticut CTDPA: no specific period after refusal).
Appeals must be submitted to: privacy@aqnova.co [Subject: Privacy Rights Appeal — [Request Reference Number]]. The appeal must include: (a) the reference number of the original request; (b) a description of the right you sought to exercise; (c) the specific grounds on which you disagree with AqNova's refusal; and (d) any additional information or documentation supporting your appeal.
AqNova will acknowledge your appeal within 5 Business Days and provide a substantive response within the applicable statutory appeal period. The appeal is reviewed by a senior member of AqNova's Privacy team who was not involved in the original request determination.
B. Statutory Appeal Requirements by Jurisdiction
| Jurisdiction | Appeal Period & Process | Further Escalation |
|---|---|---|
| EU/UK — GDPR | No specific appeal period mandated; AqNova: 30 days to submit appeal. If appeal refused, right to lodge complaint with lead supervisory authority. | EDPB (EU): edpb.europa.eu | ICO (UK): ico.org.uk |
| California — CCPA/CPRA | No specific internal appeal period specified. AqNova: 30 days. If appeal refused, consumer may escalate to CPPA. | California Privacy Protection Agency: cppa.ca.gov |
| Colorado — CPA | No specified internal appeal period. AqNova: 30 days. AqNova must respond within 60 days of receiving the appeal. | Colorado AG: coag.gov/privacy |
| Virginia — CDPA | Appeal within reasonable time. AqNova must respond within 60 days. | Virginia AG: oag.state.va.us |
| Connecticut — CTDPA | Appeal within reasonable time after denial. | Connecticut AG: ct.gov/ag |
| Canada — PIPEDA | AqNova: 30 days. If unresolved, complaint to OPC. | OPC: priv.gc.ca | Quebec: cai.gouv.qc.ca |
| Brazil — LGPD | AqNova: 15 days to review appeal. | ANPD: gov.br/anpd |
| South Africa — POPIA | AqNova: 30 days to review appeal. | Information Regulator: inforegulator.org.za |
| India — DPDPA | AqNova: 15 days to review appeal. Unresolved: refer to Data Protection Board. | Data Protection Board of India (pending operationalization) |
| Australia | AqNova: 30 days. If unresolved: complaint to OAIC. | OAIC: oaic.gov.au |
| Singapore — PDPA | AqNova: 30 days. If unresolved: complaint to PDPC. | PDPC: pdpc.gov.sg |
| Japan — APPI | AqNova: 2 months. If unresolved: complaint to PPC. | PPC Japan: ppc.go.jp |
| South Korea — PIPA | AqNova: 10 days. Unresolved: PIPC. | PIPC: pipc.go.kr |
| Nigeria — NDPA | AqNova: 30 days. Unresolved: NDPC. | NDPC: ndpc.gov.ng |
3.4.14 AqNova Privacy Rights — Complete Contact Directory
| AqNova — Data Subject Rights & Privacy Contacts PRIMARY RIGHTS PORTAL: [aqnova.co/privacy/rights] DO NOT SELL / SHARE PORTAL: [aqnova.co/privacy/do-not-sell] COOKIE PREFERENCE MANAGER: [aqnova.co/privacy/cookies] DATA EXPORT (Self-Service): Account > Privacy Settings > Download My Data General Privacy Inquiries: privacy@aqnova.co Data Protection Officer (DPO): dpo@aqnova.co EU/UK GDPR Representative: gdpr@aqnova.co Brazil LGPD Encarregado: privacy@aqnova.co [Subject: LGPD — Brazil DPO] India Grievance Officer (DPDPA): grievance-india@aqnova.co South Africa Information Officer: privacy@aqnova.co [Subject: POPIA — South Africa] Nigeria NDPC Contact: privacy@aqnova.co [Subject: NDPC — Nigeria] Korea PIPA Domestic Representative: privacy@aqnova.co [Subject: PIPA — Korea] Rights Appeals: privacy@aqnova.co [Subject: Privacy Rights Appeal] Automated Decision Review: privacy@aqnova.co [Subject: Automated Decision Review] Do Not Sell / Share (California): privacy@aqnova.co [Subject: Do Not Sell — CA] Authorized Agent Requests: privacy@aqnova.co [Subject: Authorized Agent Request] Data Breach Reports: security@aqnova.co Legal Notices (Formal): legal@aqnova.com Postal: Data Protection Officer, Arivon Holding Corporation, 2571 Saturn Avenue, Unit #265, Huntington Park, CA 90255, USA California File Number: B20250418195 | EIN: 41-3210066 | D-U-N-S: 142957477 GB EORI: GB511467217000 Nigeria (Sahara Eagle Ltd): Reg: 1957145 | Tax ID: 31052811-0001 | NEPC: 0030281 |
|---|
AqNova Marketplace | Global Legal Footer Framework | Sections 3.3 & 3.4: Do Not Sell & Data Subject Rights Portal
© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.