Multi-jurisdiction removal, documented.
Five regimes, one product
GDPR (EU/EEA), UK GDPR, CCPA/CPRA (California), DPDPA (India), and Swiss FADP — each has different mechanics. We file under the statute that gives you the strongest right in your region.
Filed by section, not vibe
Every removal email we send cites the exact statute and section the broker must respond under. No fluffy 'pursuant to applicable law' boilerplate. Specificity is what makes these requests enforceable.
The controller is named on every request
We do not file anonymously or under an unidentified shell. NCRYPTO Labs Private Limited (India) or its EU representative is named as the controller / data fiduciary on every request, with a postal address brokers can use to verify.
Why this page exists
KnytX markets cross-regime data removal. Truthful-advertising regimes — FTC Act §5 in the US, the UK CMA, the EU Unfair Commercial Practices Directive, and the Indian Consumer Protection Act — require that claim to be substantiated. This page is the substantiation.
If you are a regulator reading this, the section citations below are the statutes and regulations we file under; we are happy to share sample request templates on request to legal@knytx.com.
If you are a customer reading this, the table tells you which law your removal is filed under, which authority you can escalate to, and which KnytX entity bears controller responsibility for your data.
The matrix
| Region | Removal statute | Filing window | Authority for complaints | Controller / Fiduciary of record |
|---|---|---|---|---|
| California, USA | CCPA §1798.105 (right to delete). DELETE Act / SB 362 (Civ. Code §1798.99.80 et seq.) for the consolidated registered-broker pipeline. | 45 days, extendable by 45 days with notice. | California Privacy Protection Agency (CPPA) and California Attorney General. | NCRYPTO Labs Private Limited (business under CCPA). KnytX, as authorised agent under §1798.140(i). |
| Other US states with comprehensive privacy laws | State-specific delete rights — Virginia VCDPA §59.1-577, Colorado CPA §6-1-1306, Connecticut CTDPA §10, Utah UCPA §13-61-203, Texas TDPSA §541.052, etc. | 45 days (most states), with single 45-day extension. | State Attorney General in each state. | NCRYPTO Labs Private Limited (controller). |
| EU / EEA | GDPR Article 17 (right to erasure). Article 21 (right to object) where erasure is contested. | 30 days, extendable to 90 days with reasoned notice. | The supervisory authority in the member state where you reside or where the alleged infringement occurred. EDPB coordinates cross-border. | NCRYPTO Labs Private Limited (controller under Article 4(7)). EU representative appointed under Article 27 where required. |
| United Kingdom | UK GDPR Article 17 + Data Protection Act 2018. | 30 days, extendable. | Information Commissioner’s Office (ICO). | NCRYPTO Labs Private Limited. UK representative under DPA 2018 §83 where required. |
| Switzerland | Federal Act on Data Protection (FADP, revised 1 September 2023), Article 32 (right to deletion). | “Within a reasonable time” — we treat it as 30 days. | Federal Data Protection and Information Commissioner (FDPIC). | NCRYPTO Labs Private Limited. |
| India | DPDPA, 2023 §13 (right to erasure of personal data of the Data Principal). | “Within a reasonable period” pending Rules — we treat it as 30 days. | Data Protection Board of India (once operationalised); Ministry of Electronics and Information Technology in the interim. | NCRYPTO Labs Private Limited (Data Fiduciary). |
| Brazil | LGPD Art. 18(VI) (right to delete personal data processed under consent). | 15 days. | Autoridade Nacional de Proteção de Dados (ANPD). | NCRYPTO Labs Private Limited. |
| Canada (federal) | PIPEDA Principle 4.5 (limited withdrawal of consent and disposal). Quebec Law 25 for Quebec residents. | Reasonable period; Quebec Law 25 sets stricter timelines. | Office of the Privacy Commissioner of Canada (OPC). Commission d’accès à l’information for Quebec. | NCRYPTO Labs Private Limited. |
| Australia | Privacy Act 1988, APP 11.2 (destruction or de-identification when no longer needed). Notifiable Data Breaches scheme. | Reasonable timeframe. | Office of the Australian Information Commissioner (OAIC). | NCRYPTO Labs Private Limited. |
Where a broker operates across multiple regimes, we file under whichever statute gives you the strongest right and the shortest compliance window. We cite the statute by section number on the request itself so the broker cannot rely on ambiguity.
How we decide which statute applies to you
Your “applicable regime” is determined by your residency, not by where the broker is headquartered or where the data was originally collected. Specifically:
- We use the residency you declared at signup, refined by ongoing signals (billing country, IP region history).
- If your declared residency and your signals diverge, we ask you. We do not silently file under a regime you did not consent to.
- If you are dual-resident — for example, an EU citizen working temporarily in California — we file under whichever regime gives you the stronger right and the broader scope. You can override our default at request time.
What we do not file under
- “Right to be forgotten” alone. This is a journalistic shorthand for the Costeja v. Google line of EU case law. Our requests cite the statutory article (GDPR Article 17), not the shorthand, because brokers can stall against shorthand.
- “Privacy law” as a generic phrase. We never send a removal email that says “pursuant to applicable privacy law” without a section number. Vagueness benefits the broker.
- Tortious or defamation claims. Those require a court and an attorney. KnytX files administrative privacy requests, not legal complaints.
When a broker refuses or partially complies
Statutory exceptions exist in every regime — fraud prevention, security, public-interest journalism, compliance with another law. When a broker invokes an exception we:
- Record the cited exception in your dashboard, verbatim.
- Assess whether the exception facially applies. If we believe it does not, we file a follow-up request citing the same authority and asking for a written justification.
- If the refusal persists and we believe it is improper, we escalate by helping you draft a complaint to the relevant supervisory authority (CPPA, ICO, the relevant DPA, FDPIC, etc.).
We do not litigate on your behalf. We do not threaten litigation. We do not promise the broker a “lawsuit” if they refuse — that is not our authority and it tends to make the situation worse, not better.
The controller-of-record question
For every request we file, NCRYPTO Labs Private Limited is named as the controller (GDPR / UK GDPR), business (CCPA), or Data Fiduciary (DPDPA). Some thoughts on the joint-controller question:
- Dark-web vendor lookups (Pro tier). When we send a hashed identifier to SpyCloud, Hudson Rock, or DarkOwl on your behalf, our position is that we remain the sole controller and the vendor is a processor under GDPR Article 28 / DPDPA §8(7). We have signed processor agreements that say so. A regulator could argue this is joint controllership under Article 26; our DPIA addresses this and we are prepared to defend the processor characterisation, with a fallback joint-controller arrangement documented if a regulator disagrees.
- PimEyes reverse-image search (Executive tier). This is the closest case to joint controllership in our pipeline, because PimEyes operates a public-facing search service with its own purposes. Our position is that we use the API only for a defined, bounded purpose (impersonation defense) and that PimEyes is a processor for that limited interaction. We disclose this in our sub-processor list.
- The CPPA mechanism (DELETE Act). The CPPA portal is a state-administered system, not a sub-processor. NCRYPTO Labs Private Limited acts as your authorised agent in filing.
Postal addresses and points of contact
For each regime, the controller-of-record can be contacted at:
- Primary (all regimes): NCRYPTO Labs Private Limited, Bangalore, Karnataka, India. legal@knytx.com.
- EU representative (GDPR Art. 27): appointed and named on filings where required.
- UK representative (DPA 2018 §83): appointed where required.
Supervisory-authority contact details are listed in Section 6 of the main Privacy Policy.
Updates to this matrix
When a new privacy law comes into force that we can file under — for example, a US federal privacy law if Congress passes one, or new EU regulations — we update this matrix and the underlying request templates. Material changes are summarised in our annual transparency report.
If you spot an error or a missing regime, please email legal@knytx.com. This page is meant to be accurate, not promotional.