As outlined in the summary, individuals (data subjects) have a number of rights regarding their personal data. HGA is committed to respecting and facilitating these rights. The availability of certain rights may depend on your residency or citizenship (for example, GDPR grants these rights broadly to EU data subjects, CCPA grants specific rights to California residents), but HGA’s policy is generally to honor these core rights for all users to the extent possible. Below we describe each right and how you can exercise it:

1. Right to Access: You have the right to request a copy of the personal data we hold about you and to obtain information about how we process it. This is sometimes called a “Data Subject Access Request.” Upon request, we will confirm if we are processing your personal data and provide you with a copy of that data, as well as details such as the purposes of processing, the categories of data, any third parties it’s shared with, and the planned retention period, all as required by law. We will provide this in a commonly used electronic form (unless you request otherwise). For California residents, the right to access includes the right to know the categories of personal information collected, the sources of that information, the business purpose for collection, the categories of third parties with whom it is shared, and if applicable, the specific pieces of personal information obtained. We aim to provide as much detail as reasonably possible.
2. Right to Rectification (Correction): If any of your personal data that we have is incorrect or incomplete, you have the right to have it corrected. You can also update many pieces of information yourself directly on your account profile (for example, you can log in and edit your contact information, CV details, etc.). For any data not editable by you, contact us with the specifics of the correction needed and we will rectify our records. We may need to verify the accuracy of the new information you provide, but we will update it promptly and inform any third parties as required (if, for instance, we had previously shared incorrect data with someone, we’ll inform them of the correction if required by law).
3. Right to Deletion (Right to be Forgotten): You may request that we delete your personal data. This right is not absolute – it applies in certain circumstances, for example if the data is no longer needed for the purposes it was collected, or if you withdraw consent and we have no other legal basis to keep it, or if we processed your data unlawfully. We will honor valid deletion requests by erasing your personal data from our active systems, and instructing our processors to do the same. However, we will notify you if there are categories of data we cannot fully delete because of legal obligations or other exceptions. Common examples include where we must retain transaction records for tax purposes, or where data is needed to establish or defend legal claims. In such cases, we will restrict the data so it is no longer actively processed. California residents: The CCPA grants a right to request deletion of personal information collected from you (with similar exceptions). If you request deletion, we will remove the data we are not obligated to keep, and we will tell you the outcome of your request.
4. Right to Restrict Processing: You have the right to request that we limit the processing of your personal data in certain cases – for instance, if you contest the accuracy of the data, you can ask us to pause processing (other than simply storing it) until we verify and correct it; or if you object to our processing (see the right to object below) and we are considering that objection; or if the processing is unlawful but you prefer restriction instead of deletion; or if we no longer need the data but you need us to keep it for a legal claim. When processing is restricted, we will store the data securely and not use it except to the extent allowed (e.g., to exercise legal rights or with your consent). We will inform you before lifting any restriction. We also inform any third parties who received the data (if required) so they don’t continue processing it.
5. Right to Object: You have the right to object to our processing of your personal data in certain situations: – Legitimate Interests: If we are processing your data based on our legitimate interests (or those of a third party), you can object to that processing if you feel it impacts your fundamental rights and freedoms. If you raise an objection, we will evaluate it. We may continue processing if we can demonstrate compelling legitimate grounds that override your interests, or if the processing is for the establishment, exercise, or defense of legal claims. Otherwise, we will cease the processing in question. – Direct Marketing: You can always object to your data being used for direct marketing. If, for example, you no longer wish to receive our newsletter or promotional emails, you can opt out by clicking “unsubscribe” in those emails or by contacting us. Once you object or opt-out, we will stop using your data for marketing purposes immediately. (There’s no exception to this – we will honor all such requests.)
6. Right to Data Portability: For data that you have provided to us, you have the right to receive it in a structured, commonly used, machine-readable format, and you have the right to transmit that data to another controller (for example, to another platform), where technically feasible. This right applies when the processing is based on your consent or on a contract with you, and the processing is carried out by automated means. In practice, this might include things like the core profile information you provided, your CV details, etc. If you request it, we will provide a digital file (for example, a CSV or JSON file) containing the personal data that you provided to us and that we process electronically. If you prefer and it’s feasible, we can also directly transmit the data to another service provider at your direction (though often it’s simpler for you to handle the file).
7. Right to Withdraw Consent: In cases where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. For example, if you gave consent for us to use your testimonial on our website, you can withdraw it and we will remove your testimonial. Or if you consented to optional cookies, you can change your preference. Withdrawing consent will not affect the lawfulness of any processing we conducted prior to the withdrawal, and it won’t affect processing under other legal bases. However, if consent was the only legal basis for certain processing, we will stop that processing. Note that if you withdraw consent for data that is necessary for us to provide the Platform services, it may impact our ability to serve you. For instance, a consultant who withdraws consent for us to share their CV with any clients would essentially disable our core service; we would inform you of the implications at that time (as the consultant contract notes, withdrawing consent might affect our ability to secure engagements for you[34]).
8. Rights Related to Automated Decision-Making: HGA does not make any solely automated decisions (with no human involvement) that produce legal or similarly significant effects about individuals (like decisions on eligibility for jobs or credit solely by algorithm without human review). If we ever implement automated decision-making, you would have the right to not be subject to such decisions in certain cases, and to request human intervention. Currently, any automated processes (like consultant-project matching suggestions) involve humans in the loop and/or do not have final decision authority without review.
9. Right to Non-Discrimination (CCPA specific): If you exercise any of your rights under CCPA as a California resident, we will not discriminate against you for doing so. This means we will not deny you our services, charge you different prices, or provide a different quality of service just because you exercised your privacy rights. HGA provides equal service to all users regardless of any privacy choices you make (within the bounds of being able to actually provide the service).
10. Right to Lodge a Complaint: If you believe we have not complied with applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. For EU residents, this would be the Data Protection Authority in the member state of your habitual residence or where an alleged infringement occurred. For example, in France it’s the CNIL, in Nigeria it’s the NITDA for data protection, in Kenya the Office of the Data Protection Commissioner, etc. In the UK, it’s the ICO; in California, you can contact the California Attorney General’s office or the CPPA; in other jurisdictions, there will be an equivalent regulator. We encourage you to first reach out to us so we can attempt to address your concerns directly, but you are free to contact the authorities at any time.

How to Exercise Your Rights: To exercise any of your data subject rights, please contact us using the contact information provided in the Contact Us section below. If you have an account, you may also have access to self-service tools for some rights (for example, an account settings page to update info or download data, or a deletion function). When you contact us, please clearly describe your request – for example, “I want to access my data” or “Please delete X information” – and include enough information for us to verify your identity. We take the privacy of all accounts seriously, so we will need to ensure that the person making a request is actually the person to whom the data belongs (or their authorized representative). For verification, we may ask you to provide certain information or identification that matches our records. If you are using an authorized agent (like a lawyer or someone with power of attorney) to make the request on your behalf (as allowed under CCPA for instance), we will need proof of that authorization.

Response Time: We will respond to your request as soon as possible and within the timeframe required by law. Under GDPR, this is generally within 1 month (with a possible extension of 2 further months for complex requests, in which case we will inform you of the need for more time). Under CCPA, we aim to respond within 45 days (and can extend once by another 45 days if necessary, with notice). Our response will typically be free of charge, but note that for unfounded or excessive requests (especially repeated requests), data protection laws allow us to charge a reasonable fee or refuse to act. We will, of course, inform you if any fee or refusal is applicable and why.

Limitations: Please be aware that some rights have limitations. For example, if fulfilling your deletion request would prevent us from complying with a legal obligation (such as keeping certain financial data), we may deny that part of the request and will inform you of the reason. Similarly, the right to data portability covers only data you provided, not data we generated, and only when technically feasible. We will always explain our reasoning if we cannot fully comply with a request.

HGA is dedicated to upholding your rights. We have internal procedures to handle such requests and a team that reviews them. You will not have to wonder about the status – we will keep you updated.

If you have any questions about your rights or how to exercise them, please reach out to us. Your privacy and control over your information are top priorities for us.