Insula LLC
a California limited liability company doing business as Imcy
California Secretary of State file no. B20260266445
4653 Carmel Mountain Rd, Ste 308 PMB 1106, San Diego, California 92130-6650, USA
support@imcy.world

DATA REQUEST FORM

The website form parents use to exercise their privacy rights, and Imcy's handling rules

Version. Draft 1 · November 6, 2026

Effective date. 10 November 2026. Last updated. 10 November 2026.

Related documents. 1.4 Privacy Policy; 1.6 Notice at Collection

CONTENTS

Article 1 Requester details

Article 2 Request type

Article 3 Identity check

Article 4 Authorized agent

Article 5 Response timeline

Article 6 Handling rules for Imcy

Article 7 Records

Part A (articles 1 to 4) is the form as it appears on the website. Part B (articles 5 to 7) sets out how Imcy handles each request.

1. REQUESTER DETAILS

FORM FIELDS
Full name (required)
Email address used with Imcy (required)
Phone number used with Imcy (optional)
Country and, for US residents, state (required)
I am: ○ the client (parent or guardian) the information is about ○ an authorized agent acting for the client (required)

WEBSITE TEXT
Imcy holds no information about children. For information about your child held by your coach, please contact your coach directly. If you send that request to us, we will pass it to your coach and tell you.

2. REQUEST TYPE

FORM FIELDS (tick all that apply)
☐ Access: tell me what information you hold about me and send me a copy
☐ Portability: send my information in a machine-readable format
☐ Correct: correct inaccurate information (please describe)
☐ Delete: delete my information
☐ Opt out: of sale or sharing for advertising, and of marketing messages
☐ Limit: limit the use of sensitive personal information
☐ Object or restrict: object to or restrict a particular use (please describe)
☐ Withdraw consent: for email, WhatsApp or cookies
☐ Appeal: I disagree with your decision on an earlier request
Details (optional, up to 500 characters). Please do not include information about your child.

3. IDENTITY CHECK

WEBSITE TEXT
To protect your information, we will email a confirmation link to the address you give. For access or deletion we may also ask you to confirm a recent booking date or the last four digits of the card used. We will never ask for your full card number, password or identity documents unless no other check is possible.

4. AUTHORIZED AGENT

WEBSITE TEXT
If you act for someone else, please upload their signed permission or a power of attorney. We may also ask the client to confirm their identity and the permission directly with us.
Agent name, email and the client's name (required for agents) · Upload: signed permission (required for agents)
☐ I confirm that the information in this form is accurate. (required)

5. RESPONSE TIMELINE

5.1 Acknowledgement. Imcy confirms receipt within 10 business days and explains how it will verify and respond.

5.2 Response. Imcy responds within one month of receipt for requests under the GDPR or UK GDPR, extendable by two further months for complex requests; within 45 days for requests under the CCPA or other US state laws, extendable once by 45 days; and within 30 days under the Australian Privacy Act, where it applies. Imcy tells the requester of any extension and the reason.

5.3 Opt-outs. Requests to opt out of sale or sharing or of marketing are acted on as soon as possible and within 15 business days, without identity checks beyond what is needed. A STOP reply on WhatsApp takes effect immediately.

5.4 Free of charge. Requests are free, unless manifestly unfounded or excessive, in which case Imcy may refuse or charge a reasonable fee and explains why.

6. HANDLING RULES FOR IMCY

6.1 Search. Search every system that may hold the requester's information: Acuity, Stripe, HubSpot, Google Workspace (support@imcy.world), QuickBooks, messaging tools and the website and consent tools.

6.2 Deletion limits. Payment, tax and accounting records are kept for the legal retention period and the requester is told so. Booking and acceptance records may be kept while needed for a legal claim.

6.3 Coach and Supervisor data. Pass any request about information held by a Coach or the Supervisor to them within 5 business days and tell the requester. Never ask for, or forward to an Imcy system, information about a child.

6.4 Refusals and appeals. Give written reasons for any refusal and explain how to appeal and how to complain to the relevant regulator. Decide an appeal within 45 days (60 days in Colorado), by a person not involved in the original decision where possible.

7. RECORDS

7.1 Request log. Keep a log of each request for at least 24 months: date received, request type, how identity was verified, the response and its date, and any appeal. The log never contains information about a child.

7.2 Annual review. Review the log every year to check that timelines are met.