GDPR Compliance

Contractual Necessity (Article 6(1)(b))

Processing necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes account creation, service delivery, payment processing, and customer support.

Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests or those of a third party, provided your rights do not override these interests. This includes fraud prevention, network security, improving our services, and direct marketing (with opt-out options).

Legal Obligation (Article 6(1)(c))

Processing necessary to comply with legal obligations, such as tax reporting, responding to lawful requests from authorities, and maintaining records required by law.

Consent (Article 6(1)(a))

Processing based on your freely given, specific, informed, and unambiguous consent. This applies to marketing communications, cookies, and optional data collection. You can withdraw consent at any time.

Technical Measures

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Pseudonymization and anonymization where appropriate
• Access controls and role-based permissions
• Multi-factor authentication for all accounts
• Automated vulnerability scanning and patching
• Secure development lifecycle practices
• Regular penetration testing and security audits

Organizational Measures

• Appointed Data Protection Officer (DPO)
• Staff training on GDPR and data protection
• Data Protection Impact Assessments (DPIAs) for high-risk processing
• Documented policies and procedures
• Vendor due diligence and Data Processing Agreements
• Incident response and breach notification procedures
• Regular compliance audits and reviews
• Privacy by Design and Privacy by Default principles

EU Data Residency

For EU customers, primary data storage is within EU data centers (Estonia, Germany) to ensure data sovereignty and minimize transfer risks.

Transfer Safeguards

When transfers outside the EEA are necessary, we implement appropriate safeguards:

• Standard Contractual Clauses (SCCs): EU Commission-approved clauses with all processors and sub-processors
• Adequacy Decisions: Transfers to countries deemed adequate by the EU Commission
• Binding Corporate Rules: For intra-group transfers (where applicable)
• Supplementary Measures: Additional technical measures beyond SCCs (encryption, access controls)

Transfer Impact Assessments

We conduct Transfer Impact Assessments (TIAs) as required by Schrems II guidance to evaluate risks of transfers to third countries and implement additional safeguards where necessary.

Detection & Response

24/7 security monitoring with automated anomaly detection. Incidents are immediately escalated to our incident response team. Mean time to detection (MTTD) is under 15 minutes.

Supervisory Authority Notification

We notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of a breach likely to result in a risk to individuals' rights and freedoms, as required by Article 33.

Individual Notification

If a breach is likely to result in a high risk to individuals' rights and freedoms, we will communicate the breach directly to affected individuals without undue delay, as required by Article 34.

Breach Documentation

We maintain records of all personal data breaches, including facts, effects, and remedial actions taken, in accordance with Article 33(5).