GDPR Compliance Statement

Your Rights Under GDPR

The GDPR grants you comprehensive rights regarding your personal data. As a data subject, you are entitled to exercise the following rights at any time:

Right of Access (Article 15)

You have the right to obtain confirmation as to whether we are processing your personal data. If so, you can request access to that data and receive a copy of it, along with information about the processing purposes, categories of data, recipients, and retention periods.

Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data concerning you without undue delay. You may also request that incomplete personal data be completed, including by providing a supplementary statement.

Right to Erasure / Right to Be Forgotten (Article 17)

You have the right to request the deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Erasure is required for compliance with a legal obligation

Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing when you contest the accuracy of data, when processing is unlawful, when we no longer need the data but you require it for legal claims, or when you have objected to processing pending verification.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that we transmit this data directly to another controller where technically feasible.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

International Data Transfers

As an international service, we may transfer your personal data to countries outside the European Economic Area (EEA). When we do so, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR Chapter V.

Transfer Mechanisms

We use the following mechanisms to ensure adequate protection for international transfers:

Adequacy Decisions

Where the European Commission has determined that a third country provides an adequate level of data protection, we may transfer data to entities in that country without additional safeguards.

Standard Contractual Clauses (SCCs)

For transfers to countries without adequacy decisions, we use the European Commission's Standard Contractual Clauses approved under Decision (EU) 2021/914. These clauses impose contractual obligations on the data exporter and importer to protect personal data.

Supplementary Measures

Where required, we implement supplementary technical and organizational measures including:

• Encryption of data in transit and at rest
• Pseudonymization where feasible
• Access controls and authentication requirements
• Regular security assessments and audits

Third-Party Service Providers

We work with trusted third-party service providers who may process data outside the EEA. All such providers are contractually bound to comply with GDPR requirements and implement appropriate safeguards. Our primary service providers operate in:

• United States (EU-US Data Privacy Framework certified)
• United Kingdom (Adequacy decision)
• European Union member states

Data Protection Officer

In accordance with GDPR Article 37, we have appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with applicable regulations.

DPO Responsibilities

Our Data Protection Officer is responsible for:

• Monitoring compliance with GDPR and other data protection laws
• Advising on data protection impact assessments
• Acting as a contact point for supervisory authorities
• Handling data subject requests and inquiries
• Training staff on data protection obligations
• Conducting internal audits and compliance reviews

Policy Updates

We may update this GDPR Compliance Statement from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. When we make significant changes, we will notify you through appropriate means.

Notification Methods

• Email notification to registered users for material changes
• Prominent notice on our website homepage
• In-app notification where applicable
• Updated "Last Modified" date at the top of this document

Version History

• Version 2.1 (January 2026): Updated international transfer mechanisms, added DPO contact details
• Version 2.0 (June 2026): Comprehensive revision following CJEU rulings, updated SCCs
• Version 1.1 (January 2023): Added retention schedule table, clarified rights procedures
• Version 1.0 (May 2018): Initial GDPR compliance statement

Your Continued Use

Your continued use of our services after any changes to this statement will constitute your acknowledgment of the changes and your consent to abide by the updated terms. If you do not agree with any changes, you should discontinue use and request deletion of your data.