GDPR Compliance

2.1 Lawfulness, Fairness, and Transparency

We process data lawfully, fairly, and in a transparent manner. We clearly explain what data we collect and how we use it.

2.2 Purpose Limitation

We collect data for specific, explicit, and legitimate purposes only. We do not use data for incompatible purposes.

2.3 Data Minimization

We only collect data that is adequate, relevant, and limited to what is necessary for processing purposes.

2.4 Accuracy

We take reasonable steps to ensure personal data is accurate and up-to-date. You can request corrections at any time.

2.5 Storage Limitation

We retain personal data only as long as necessary for the purposes collected. See our Privacy Policy for retention periods.

2.6 Integrity and Confidentiality

We implement appropriate technical and organizational measures to ensure data security, including encryption, access controls, and regular security audits.

2.7 Accountability

We maintain records of processing activities and can demonstrate compliance with GDPR principles.

3.1 Right to Access (Article 15)

3.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data. We will notify third parties of corrections where appropriate.

3.3 Right to Erasure "Right to be Forgotten" (Article 17)

You can request deletion of your data when:

• Data is no longer necessary for the purposes collected
• You withdraw consent (where consent is the legal basis)
• You object to processing and there are no overriding legitimate grounds
• Data has been unlawfully processed
• Erasure is required for legal compliance

Note: This right is not absolute. We may retain data if required by law or for legitimate legal purposes.

3.4 Right to Restriction of Processing (Article 18)

You can request that we limit processing of your data when:

• You contest the accuracy of the data
• Processing is unlawful but you don't want erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification

3.5 Right to Data Portability (Article 20)

You can receive your data in a structured, commonly used, machine-readable format (e.g., JSON, CSV, XML) and transmit it to another controller.

3.6 Right to Object (Article 21)

You can object to processing based on:

• Legitimate interests
• Performance of a public interest task
• Direct marketing (absolute right)
• Profiling for direct marketing

3.7 Right to Withdraw Consent (Article 7)

Where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

3.8 Right to Lodge a Complaint (Article 77)

You have the right to file a complaint with a supervisory authority if you believe we have violated your data protection rights.

5.1 Contract Performance (Article 6(1)(b))

Processing necessary to fulfill our contractual obligations, including:

• Providing software services
• Processing payments
• Delivering technical support
• Managing your account

5.2 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests, such as:

• Fraud prevention and security
• Network and information security
• Business analytics and improvements
• Internal administrative purposes

5.3 Consent (Article 6(1)(a))

With your explicit consent for:

• Marketing communications
• Optional cookies and tracking
• Newsletter subscriptions
• Certain data sharing with third parties

5.4 Legal Obligation (Article 6(1)(c))

Processing required by law, including:

• Tax and accounting obligations
• Anti-money laundering checks
• Regulatory compliance
• Court orders and legal processes

6.1 Standard Contractual Clauses (SCCs)

We use EU-approved Standard Contractual Clauses for transfers between our UK and China entities and with third-party processors outside the UK/EEA.

6.2 Adequacy Decisions

Where available, we transfer data to countries with adequacy decisions from the European Commission or UK government.

6.3 UK-China Data Transfers

6.4 Third-Party Service Providers

Some service providers are located outside the UK/EEA:

• US Providers: Google (Cloud, Analytics), AWS, Stripe - covered by SCCs
• Other Regions: All transfers protected by appropriate safeguards

7.1 Submit a Request

To exercise any GDPR right, contact us at:

7.2 Identity Verification

To protect your privacy, we may request additional information to verify your identity before processing requests. This may include:

• Government-issued ID
• Account verification questions
• Email confirmation from registered address

7.3 Response Timeframe

We will respond to your request within 30 days. If we need more time (complex requests), we will notify you and may extend by an additional 60 days.

7.4 Free of Charge

Exercising your GDPR rights is free. We may charge a reasonable fee for:

• Manifestly unfounded or excessive requests
• Repeated requests for copies of the same information

7.5 Right to Refuse

In certain circumstances, we may refuse a request (e.g., legal obligations, legal claims). We will explain the reasons and inform you of your right to complain to a supervisory authority.

8.1 Contact Us First

We encourage you to contact us first so we can address your concerns: privacy@valutoria.com

8.2 File with Supervisory Authority