1. GDPR Commitment
CoreCapture Analytics is fully committed to compliance with the General Data Protection Regulation (GDPR) and protecting the privacy rights of all EU residents.
2. Legal Basis for Processing
We process personal data under the following legal bases:
- Consent: Marketing communications, analytics cookies
- Contract: Service delivery, account management
- Legitimate Interest: Security, fraud prevention, business analytics
- Legal Obligation: Regulatory compliance, tax records
3. Your GDPR Rights
Right of Access (Article 15)
You can request confirmation of data processing and access to your personal data.
Right to Rectification (Article 16)
You can request correction of inaccurate or incomplete personal data.
Right to Erasure (Article 17)
You can request deletion of personal data under certain circumstances.
Right to Restrict Processing (Article 18)
You can request limitation of data processing in specific situations.
Right to Data Portability (Article 20)
You can request transfer of your data to another controller in a structured format.
Right to Object (Article 21)
You can object to processing based on legitimate interests or direct marketing.
Rights Related to Automated Decision-Making (Article 22)
You have rights regarding automated processing and profiling decisions.
4. Data Protection Measures
- End-to-end encryption for data in transit and at rest
- Regular security audits and penetration testing
- Staff training on data protection principles
- Privacy by design in system development
- Data minimization and purpose limitation
- Secure data centers with physical access controls
5. Data Processing Records
We maintain comprehensive records of processing activities including:
- Categories of personal data processed
- Purposes of processing
- Legal basis for each processing activity
- Data retention periods
- Technical and organizational security measures
6. International Data Transfers
When transferring data outside the EU, we ensure adequate protection through:
- EU-US Data Privacy Framework participation
- Standard Contractual Clauses (SCCs)
- Adequacy decisions where applicable
- Binding corporate rules for internal transfers
7. Breach Notification
We have procedures to:
- Detect and assess data breaches within 72 hours
- Notify supervisory authorities when required
- Inform affected individuals of high-risk breaches
- Document all breaches and response actions
8. Data Protection Officer
Contact our Data Protection Officer for GDPR-related matters:
Email: [email protected]
Phone: +1 (415) 555-0847
Address: CoreCapture Analytics, DPO Office
2847 Market Street, San Francisco, CA 94114, USA
9. Exercising Your Rights
To exercise your GDPR rights:
- Submit requests via email to [email protected]
- Include proof of identity and specific request details
- We respond within one month (extendable to three months for complex requests)
- No fee charged unless requests are excessive or unfounded
10. Complaints and Supervisory Authority
You have the right to lodge complaints with supervisory authorities. For EU residents, contact your local data protection authority or our lead supervisory authority.
11. Privacy Impact Assessments
We conduct Privacy Impact Assessments (PIAs) for high-risk processing activities and implement appropriate safeguards based on assessment results.
12. Consent Management
When processing is based on consent:
- Consent is freely given, specific, informed, and unambiguous
- Easy withdrawal mechanisms are provided
- Separate consent obtained for different processing purposes
- Clear records maintained of consent decisions
Last Updated: December 2024
Next Review: June 2025
