Data Subject Request (DSAR)

At PantoSource ("Company," "we," "us," or "our"), we respect the privacy of individuals whose data we may process when providing our services. This page explains how to submit a Data Subject Access Request (DSAR) for personal data that may be processed by us, and the steps we take to respond.

1. Who We Are

PantoSource provides marketing analytics and attribution solutions to e-commerce businesses (our "Customers"). In doing so, we may process personal data on behalf of these customers.

Under laws such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA):

• Our Customers are typically the "data controller" — they decide what data is collected and for what purposes

• PantoSource is typically the "data processor" — we process data on behalf of our customers according to their instructions

2. Your Data Subject Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data, including:

Right to Access Receive a copy of personal data we hold about you.

Right to Rectification Correct inaccurate or incomplete personal data.

Right to Erasure Request deletion of personal data ("right to be forgotten").

Right to Restriction Ask us to limit how your data is processed.

Right to Object Object to certain data uses (e.g., direct marketing).

Right to Portability Obtain your personal data in a structured, commonly used format.

Right to Withdraw Consent Withdraw previously given consent for data processing.

To exercise any of these rights, please follow the instructions below.

3. How to Submit a Request

3.1 If You Are a Website Visitor or End User

If you visited a website or online store that uses PantoSource's tracking services:

Step 1: Contact the Website Owner First

The website or store you interacted with is your primary point of contact. They act as the data controller and are responsible for:

• Deciding what data is collected

• Determining the purposes for data collection

• Responding to your data subject requests

Step 2: The Website Owner May Contact Us

If the website owner determines that PantoSource holds data relevant to your request, they can forward the request to us. We will assist them by locating, exporting, or deleting the relevant data in accordance with our contractual obligations.

3.2 If You Are a PantoSource Customer

If you or your organization have a direct account with PantoSource and you want to exercise your data rights regarding your account information (e.g., billing details, support interactions, login credentials), please email us at:

privacy@pantosource.com

Please include in your request:

• Your full name

• Email address associated with your PantoSource account

• Company name (if applicable)

• A clear description of your request (access, correction, deletion, etc.)

• Any relevant details to help us locate your data

4. Verification & Response Timeline

4.1 Identity Verification

To protect your privacy and prevent unauthorized access to personal data, we may request additional information to verify:

• Your identity

• Your authority to make a request on behalf of someone else

We will only use information provided for verification purposes.

4.2 Response Timeline

GDPR (EU/UK) We will respond within 30 days. For complex requests, we may extend this by up to 60 additional days.

CCPA (California) We will respond within 45 days. If reasonably necessary, we may extend this by up to 45 additional days.

Other Jurisdictions We will respond within 30 days, or as permitted by applicable law.

If we need additional time, we will notify you of the extension and explain the reason.

5. Our DSAR Process

Step 1: Request Reception We review each DSAR to determine whether it falls under our scope as a processor or as a direct controller for certain data. If you're an end user of a PantoSource customer, we may refer you back to that customer.

Step 2: Data Identification If the request is valid and pertains to data we hold, we search our systems for relevant records (e.g., analytics events, billing records, support logs).

Step 3: Data Compilation & Review We compile the responsive data and, if necessary, confirm with our customer (the controller) that releasing or deleting this data aligns with our legal and contractual obligations.

Step 4: Response For valid requests, we provide:

• The requested information in a structured, machine-readable format (CSV or JSON), or

• Confirmation that the data has been deleted or anonymized

6. Exceptions & Limitations

We may deny or limit a DSAR in the following circumstances:

Legal Obligations If fulfilling the request would violate legal requirements or infringe upon the rights of others.

Retention Requirements If certain data must be retained for compliance, dispute resolution, tax/accounting purposes, or contract administration, we may not fully delete it until those obligations expire.

Manifestly Unfounded or Excessive Requests If a request is clearly unfounded, repetitive, or excessive, we may charge a reasonable fee or refuse to act on the request.

Verification Failure If we cannot verify your identity or authority to make the request.

7. Controller vs. Processor Responsibilities

PantoSource as Processor

For most end-user data collected via our tracking services, PantoSource acts as a processor. We follow the instructions of our customers (the controllers) regarding data storage, processing, and deletion.

If you are an end user whose data was collected by one of our customers, please contact that business directly to exercise your rights.

PantoSource as Controller

For data we collect directly from our business customers and account holders (e.g., billing information, support communications, account credentials), PantoSource acts as a controller.

DSARs related to such data can be directed to us at privacy@pantosource.com.

8. Opt-Out of Sale/Sharing (California Residents)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt out of the "sale" or "sharing" of their personal information.

Note: PantoSource does not sell personal information for monetary consideration.

If you wish to opt out of any sharing of personal information for cross-context behavioral advertising purposes, please:

• Email us at privacy@pantosource.com with subject line "Do Not Sell/Share My Information"

• Include your name and email address associated with any PantoSource account

9. Authorized Agents

You may designate an authorized agent to submit a DSAR on your behalf. To do so:

1. Provide written authorization signed by you permitting the agent to act on your behalf

2. The agent must provide proof of their identity

3. We may contact you directly to confirm the authorization

10. Contact Information

For DSAR inquiries, verification questions, or any concerns about this process:

Address:
30 N Gould St Ste R,
Sheridan, Wyoming 82801, U
SA

Email: privacy@pantosource.com
General Support: support@pantosource.com

11. Disclaimer

This page is provided for informational purposes and does not constitute legal advice. It is intended to inform about PantoSource's DSAR process and to help end users and customers understand how requests are handled. If you have questions regarding your legal rights or obligations, please consult an attorney experienced in data protection law.