GDPR Compliance

What is GDPR?

The General Data Protection Regulation (GDPR) is a regulation enacted by the European Union in 2018 that governs the collection, processing, and storage of personal data of EU residents. It establishes strict requirements for how businesses must handle personal information and grants individuals significant rights over their data.

Even if our business is not based in the EU, we recognize that we may serve customers from EU countries, and we are committed to adhering to GDPR principles to protect the privacy of all individuals, regardless of their location.

Personal Data We Collect

Under GDPR, "personal data" means any information that can be used to identify a person, either directly or indirectly. The personal data we collect may include:

• Contact Information: Name, email address, phone number, postal address
• Business Information: Company name, job title, industry, business address
• Communication Data: Information you provide when contacting us, subscribing to newsletters, or requesting quotes
• Technical Data: IP addresses, browser type, device information, and usage data collected through cookies and analytics
• Financial Information: Payment details processed securely through third-party payment providers
• Content You Provide: Any content, images, or materials you submit for use in our services

Legal Basis for Processing

Under GDPR, we must have a legal basis for processing your personal data. We process your data based on the following legal grounds:

Consent

We process your data when you have given us explicit consent to do so. You can withdraw your consent at any time by contacting us.

Contractual Necessity

We process your data when it is necessary to fulfill a contract with you, such as providing the services you have requested.

Legitimate Interests

We may process your data for our legitimate business interests, such as improving our services, as long as these interests do not override your rights and freedoms.

Legal Obligations

We may process your data to comply with legal obligations, such as maintaining records for tax purposes or responding to lawful requests from authorities.

Your GDPR Rights

As an individual under GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the information provided at the end of this page. We will respond to your request within one month.

Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption of data in transit using SSL/TLS protocols
• Secure storage of personal data with appropriate access controls
• Regular security assessments and vulnerability testing
• Employee training on data protection and privacy
• Data minimization principles - we only collect what is necessary
• Secure disposal of data when no longer needed
• Incident response procedures for data breaches

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. The retention period depends on:

• The nature of the data and why we collected it
• Any legal obligations to retain the data
• The length of our business relationship with you
• Any ongoing legal proceedings or investigations

When data is no longer needed, we securely delete or anonymize it in accordance with our data retention policies.

International Data Transfers

If we transfer your personal data outside of the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules for intra-group transfers
• Transfers to countries with adequate data protection as recognized by the EU
• Other legally approved transfer mechanisms as required

Third-Party Data Processors

We work with trusted third-party service providers who process personal data on our behalf. These processors are carefully selected and comply with GDPR requirements. We ensure that:

• They process data only under our instructions
• They have appropriate technical and organizational security measures
• They are bound by contractual obligations to protect your data
• They assist us in responding to data subject requests

Examples of third-party processors include web hosting providers, email service providers, payment processors, and analytics services.

Cookies and GDPR

Our use of cookies and similar tracking technologies is governed by our Cookies Policy. Under GDPR, some cookies may process personal data and require your consent before being placed on your device. We:

• Provide clear information about what cookies we use and why
• Obtain your consent before placing non-essential cookies
• Allow you to manage your cookie preferences
• Make it easy to withdraw consent at any time

Please review our Cookies Policy for more details.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Our data breach response procedures include identifying the breach, assessing the risk, implementing containment measures, and communicating with affected individuals as required.

Privacy by Design and Default

We follow the principle of "privacy by design and default" by:

• Collecting only the minimum data necessary for our purposes
• Using pseudonymous or anonymous data where possible
• Implementing privacy settings by default
• Ensuring transparency in our data practices
• Building security into our systems and processes
• Requiring processors to provide GDPR assurances
• Respecting user rights throughout the data lifecycle

Data Protection Contact

While we are not required to appoint a formal Data Protection Officer (DPO) under GDPR given the nature and scale of our data processing activities, we have designated individuals responsible for data protection matters.

For any questions about this GDPR Compliance page, to exercise your rights, or to report a data protection concern, please contact us using the information provided below.

Updates to This Policy

We may update this GDPR Compliance page from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically to stay informed about our data protection practices.