The policy explicitly states that users are 'entitled only to the rights to request access to, and to request correction of your personal data' under the specified ordinance. This means the right to data deletion is not provided, which is the most significant barrier to a user's ability to delete their data, leading to a score of 5 (Very Difficult).