GDPR Compliance

1. Legal Basis for Processing

We process your personal data under the following legal bases:

1.1 Contractual Necessity

Processing is necessary to provide the card protection services you have subscribed to. This includes monitoring transactions, sending alerts, and maintaining your account.

1.2 Legitimate Interests

We process data to improve our fraud detection algorithms, ensure platform security, and prevent fraudulent activity. These interests are balanced against your privacy rights.

1.3 Legal Obligations

Certain processing is required to comply with financial regulations, anti-money laundering laws, and other legal requirements applicable to financial services providers.

1.4 Consent

For non-essential processing such as marketing communications or optional features, we obtain your explicit consent, which you can withdraw at any time.

2. Data Collection and Usage

2.1 What Data We Collect

We collect only data necessary to provide our services:

• Identity data (name, email address, phone number)
• Financial data (card numbers, transaction details, bank information)
• Technical data (IP address, device information, cookies)
• Usage data (how you interact with our platform)

2.2 Data Minimization

We adhere to the principle of data minimization, collecting only information that is adequate, relevant, and limited to what is necessary for the purposes stated.

2.3 Purpose Limitation

Data is used exclusively for the purposes disclosed at the time of collection. We do not use your financial data for unrelated purposes such as advertising or marketing analytics.

3. Data Sharing and Transfers

3.1 Third-Party Processors

We share data with carefully vetted service providers who assist in delivering our services. All processors are bound by data processing agreements that comply with GDPR Article 28 requirements.

3.2 International Transfers

If we transfer your data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Other legally recognized transfer mechanisms

3.3 No Data Sales

We never sell, rent, or trade your personal data to third parties for their marketing purposes.

4. Data Security

We implement appropriate technical and organizational measures to ensure data security:

• End-to-end encryption using AES-256 standard
• Regular security assessments and penetration testing
• Strict access controls and authentication requirements
• Employee training on data protection principles
• Incident response procedures for data breaches
• SOC 2 Type II certification

5. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify affected individuals within 72 hours of becoming aware of the breach
• Report the breach to relevant supervisory authorities as required
• Provide clear information about the nature of the breach and recommended actions
• Document all breaches and our response measures

6. Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Duration of active subscription plus 90 days
• Transaction records: 7 years (financial regulation requirement)
• Communication records: 3 years
• Marketing consent records: Until consent is withdrawn

After retention periods expire, data is securely deleted or anonymized.

7. Automated Decision-Making

Our fraud detection system uses automated algorithms to analyze transactions and flag suspicious activity. However:

• You can contest any automated decision
• You can request human review of flagged transactions
• Automated decisions do not have legal effects without human intervention
• We provide transparency about how our algorithms work

8. Children's Data

We do not knowingly process personal data of individuals under 16 years of age without parental consent. If we discover we have collected such data, we will delete it immediately.

9. How to Exercise Your Rights

To exercise any of your GDPR rights:

• Send an email to [email protected] with the subject line "GDPR Request"
• Clearly state which right you wish to exercise
• Provide sufficient information to verify your identity
• We will respond within 30 days (extendable by 60 days for complex requests)

You will not be charged a fee unless your request is manifestly unfounded or excessive.

10. Supervisory Authority

If you are located in the EU/EEA, you have the right to lodge a complaint with your local data protection supervisory authority. While we are based in Australia, we commit to cooperating with the relevant supervisory authority for GDPR matters.

For Australian residents, complaints can be directed to the Office of the Australian Information Commissioner (OAIC).