Skip to content
Back to Trust

Data subject request

Exercise your data rights.

We respond within 30 days under the GDPR (Articles 15-22), and within 45 days under the CCPA/CPRA (extendable once where the law allows). Submit the form and we’ll verify your identity, then process the request.

What we can and cannot action

We can action here

  • Access the personal data in your AlreadyBack account
  • Correct or delete your AlreadyBack account data
  • Export your data, or exercise another GDPR or CCPA right

Contact the data’s owner instead

  • Delete or change records inside a business’s backup — we are only the processor; ask the business that owns it
  • Change data a company holds about you in its own systems

You don’t need an AlreadyBack account to submit a request. An authorized agent may submit one on someone’s behalf with appropriate written authorization.

How this works

Nothing is sent to a server. Submitting opens your email client with everything pre-filled and addressed to privacy@alreadyback.com — send the email to register the request.

We respond to this address. Use the same one you have on your AlreadyBack account if you have one.

If the request relates to data processed under a company account, name the company here.

Request type

Describe the data, accounts, or specific records the request applies to. Include any deadlines you have.

If you have a previous ticket, contract reference, or domain that helps us verify identity, mention it here. We never accept government IDs by email.

Or email privacy@alreadyback.com directly

What happens next

  1. Submitting opens your email client with a pre-filled message to privacy@alreadyback.com. Send it to register the request.
  2. We acknowledge within 48 hours and verify your identity (one round-trip).
  3. Within 30 days (GDPR) or 45 days (CCPA/CPRA) of receiving your request we fulfill it and send you the outcome — data export, deletion certificate, or written response as applicable.
  4. For complex or high-volume requests, the law allows a one-time extension — up to two further months under the GDPR, 45 days under the CPRA. We tell you upfront if it applies.
  5. For manifestly unfounded or excessive or repetitive requests, we may charge a reasonable fee or decline — and we’ll explain why, and how to appeal the decision.

Common questions

Can I delete a single record from a backup?
No — that record belongs to the business that owns the backup. Ask them; we act only on their instruction.
Can I delete my AlreadyBack account?
Yes — choose Erasure in the form above.
Can I export my data?
Yes — choose Portability, and we return a structured, machine-readable file.
Do I need an account to ask?
No. Anyone can submit a request about the personal data we hold on them.