GDPR Compliance Policy

Introduction

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to organizations processing the personal data of individuals in the European Union (EU) and European Economic Area (EEA). This policy outlines how Contro complies with GDPR and protects your rights as a data subject.

Our Role Under GDPR

Contro acts as both a Data Controller and Data Processor:

• Data Controller: For your account information, preferences, and how we use your data to provide our services
• Data Processor: For the content you create and publish, where you determine the purposes and means of processing

Legal Basis for Processing

We process your personal data under the following legal bases:

Your Rights Under GDPR

As a data subject, you have the following rights:

How to Exercise Your Rights

To exercise any of your GDPR rights:

1. Email us at privacy@contro.co with your request
2. Include your account email and specify which right(s) you wish to exercise
3. Provide verification of your identity (we may request additional information)
4. We will respond within 30 days of receiving your verified request

There is no fee for exercising your rights unless your request is manifestly unfounded or excessive.

Data We Collect

We collect and process the following categories of personal data:

Data Retention

We retain your personal data only as long as necessary:

• Active accounts: Data retained while your account is active
• Deleted accounts: Personal data deleted within 30 days, subject to legal requirements
• Public content: May be retained longer if required by law or legitimate interests
• Backup systems: Data in backups deleted within 90 days
• Legal obligations: Some data may be retained longer to comply with tax, accounting, or legal requirements

Data Transfers

Your personal data may be transferred to and stored in countries outside the EEA. When we transfer data internationally, we ensure appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• Other legally approved transfer mechanisms

Our service providers (such as Supabase) also comply with GDPR and maintain appropriate security measures.

Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit (HTTPS/TLS) and at rest
• Access controls and authentication
• Regular security audits and vulnerability assessments
• Employee training on data protection
• Incident response and breach notification procedures

Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.

Children's Data

Contro is not intended for children under 16 years of age. We do not knowingly collect or process personal data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately so we can delete it.

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. You can contact your local data protection authority or:

Irish Data Protection Commission
(if Contro is based in Ireland)
www.dataprotection.ie

However, we encourage you to contact us first at privacy@contro.co so we can address your concerns.

Data Protection Officer

For questions about our GDPR compliance or data protection practices, contact our Data Protection Officer at: dpo@contro.co

Updates to This Policy

We may update this GDPR Policy to reflect changes in our practices or legal requirements. We will notify you of material changes and update the "Last updated" date. Your continued use of Contro after changes constitutes acceptance.

Contact Information