HQL SolutionsLegal policy centre

HQL SOLUTIONS · LAST UPDATED 8 OCTOBER 2026

Regional privacy and GDPR rights

HQL Solutions LLC. These requirements apply according to the activity, location and governing law; this notice does not certify universal compliance.

EU / EEA — GDPR

Where GDPR applies, individuals may have rights to access, rectify, erase, restrict, port data and object, as well as protections relating to certain automated decisions. Consent may be withdrawn without affecting the lawfulness of earlier processing. Objection to direct marketing is not subject to a balancing override. Requests generally require a response within one month, with a permitted extension of up to two further months for complexity or volume and notice within the initial period. Where data is obtained indirectly, the required Article 14 information must be provided within the applicable time limit, generally no later than one month, the first communication or the first disclosure, whichever applies earlier, subject to statutory exceptions. A complaint may be made to the relevant supervisory authority. HQL must assess territorial scope and whether an EU representative or DPO is required.

United Kingdom

Where UK GDPR applies, the corresponding rights and response framework apply, alongside UK-specific legislation and ICO guidance. Complaints can be directed to the Information Commissioner’s Office. HQL must assess representative and DPO requirements separately. Corporate-recipient email rules do not remove the duty to protect named employees’ personal information.

Canada

Applicable Canadian rules can include PIPEDA and provincial private-sector laws in Alberta, British Columbia and Quebec. Rights commonly include access, correction, meaningful information about handling and a route to challenge compliance or withdraw consent subject to lawful limitations. PIPEDA access requests generally have a 30-day response period, with extensions only under its conditions; provincial deadlines and requirements must be checked for the request. Quebec-specific obligations, including applicable language, governance and transfer-assessment requirements, need a separate applicability review. Complaints may be directed to the Office of the Privacy Commissioner of Canada or the relevant provincial authority. CASL marketing rights are addressed separately.

United States

Privacy rights differ by state and by whether the business and information fall within a statute. Where applicable, rights can include access, correction, deletion, portability, opt-out of sale, sharing or targeted advertising, and limits on specified sensitive-data uses. Certain states provide appeal rights or require recognition of valid universal opt-out signals. California’s CCPA/CPRA can cover business-contact information when its applicability tests are met; many other state laws exclude commercial-context information. California requests to know/delete/correct generally use a 45-day response period, with extensions under statutory conditions. Do not treat that deadline as universal. Texas Chapter 541 has its own scope and exceptions, including commercial-context and small-business provisions. HQL’s applicability, disclosures, sales/sharing, required request methods and appeals must be assessed.

How to make a request

Once a published private enquiry route is available, contact HQL Solutions through its website enquiry form and specify “Privacy request”, the email address or other information used in your dealings with HQL, the requested action and your region. Specify “Stop marketing” if that is your request. Identity verification should be proportionate; requests through an authorised agent must follow the relevant law. HQL should explain any limitation and available appeal or complaint route. A public privacy-request route has not yet been configured and must be implemented and tested before this notice takes effect.

Official references