GDPR Compliance
Your data protection rights under the General Data Protection Regulation
We are committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR). This page explains your rights, how we process your data, and the measures we take to ensure compliance.
As a data controller, we ensure that all personal data processing activities are lawful, fair, and transparent. We have implemented comprehensive policies, procedures, and technical measures to protect your data and respect your rights.
Your Rights Under GDPR
The GDPR provides you with specific rights regarding your personal data. Here's what you can do:
What this means:
We provide clear information about data collection, processing purposes, legal basis, and retention periods.
How to exercise this right:
Review our Privacy Policy and this GDPR page for comprehensive information.
What this means:
You can request access to your personal data and receive a copy in a structured, commonly used format.
How to exercise this right:
Submit a data access request through our privacy portal or contact our DPO.
What this means:
You can request correction of inaccurate data or completion of incomplete personal data.
How to exercise this right:
Update your profile directly or contact us to correct any inaccuracies.
What this means:
You can request deletion of your data when it's no longer necessary or you withdraw consent.
How to exercise this right:
Submit a deletion request through our privacy portal or contact our support team.
What this means:
You can request restriction of processing in certain circumstances, such as when contesting accuracy.
How to exercise this right:
Contact our DPO with specific details about the processing you want to restrict.
What this means:
You can receive your personal data in a structured, machine-readable format and transmit it to another controller.
How to exercise this right:
Request data export through your account settings or contact our privacy team.
What this means:
You can object to processing based on legitimate interests, direct marketing, or scientific research.
How to exercise this right:
Use opt-out mechanisms in communications or contact us to object to specific processing.
What this means:
You have rights regarding automated decision-making, including profiling, that produces legal effects.
How to exercise this right:
Contact our DPO if you believe you've been subject to automated decision-making.
Legal Basis for Processing
We only process your personal data when we have a valid legal basis. Here are the legal bases we rely on:
Examples:
Your options:
You can withdraw consent at any time through your account settings or by contacting us.
Examples:
Your options:
Processing based on contract cannot be withdrawn while the contract is active.
Examples:
Your options:
Processing for legal compliance cannot be withdrawn.
Examples:
Your options:
You can object to processing based on legitimate interests.
Data We Collect and Process
We collect different categories of personal data for specific purposes. Here's a breakdown:
Data Types:
Purpose:
Account management and communication
Retention:
Until account deletion or 3 years after last activity
Data Types:
Purpose:
Service delivery and improvement
Retention:
Up to 2 years for analytics, session data deleted after logout
Data Types:
Purpose:
Payment processing and financial records
Retention:
7 years for tax and accounting purposes
Data Types:
Purpose:
Customer support and service improvement
Retention:
3 years after case closure
Data Types:
Purpose:
Marketing communications and personalization
Retention:
Until consent withdrawal or 2 years of inactivity
Security Measures
We implement comprehensive technical and organizational measures to protect your personal data:
Encryption
All data is encrypted in transit and at rest using industry-standard encryption
Access Controls
Strict access controls ensure only authorized personnel can access personal data
Regular Audits
Regular security audits and penetration testing to identify vulnerabilities
Data Minimization
We collect and process only the minimum data necessary for our purposes
Staff Training
Regular GDPR and data protection training for all staff members
Incident Response
Comprehensive incident response plan for data breaches and security incidents
Adequacy Decisions
We primarily process data within the European Economic Area (EEA). When we transfer data to countries outside the EEA, we ensure appropriate safeguards are in place.
Safeguards for Transfers
Standard Contractual Clauses
We use EU-approved Standard Contractual Clauses for transfers to third countries.
Adequacy Decisions
We transfer data to countries with adequacy decisions from the European Commission.
Third-Party Processors
Our third-party service providers are contractually bound to protect your data and comply with GDPR requirements. We conduct due diligence on all processors and maintain data processing agreements.
Our Commitment
In the unlikely event of a data breach, we are committed to transparency and will follow all GDPR requirements for breach notification.
Authority Notification
We notify supervisory authorities within 72 hours of becoming aware of a breach.
Individual Notification
We notify affected individuals when there's a high risk to their rights and freedoms.
Documentation
We maintain detailed records of all data breaches and our response measures.
Data Protection Officer
123 Privacy Street
Data Protection City, DP 12345
United States
EU Representative
456 GDPR Avenue
10115 Berlin
Germany