The General Data Protection Regulation (GDPR) is the European Union's core data privacy law, in effect since May 25, 2018. It replaced the earlier 1995 Data Protection Directive and exists to give EU citizens real control over their personal data — and to make data protection rules consistent across every EU member state.
Consent comes first. We don’t collect or process personal data without it. Every individual in our database has opted in, after being told clearly what their data is used for and how it’s processed.
The right to access. Individuals can request a clear account of what personal data we hold about them, where it came from, and how it’s being used.
The right to correction. If a record is inaccurate or outdated, individuals can request a correction, and we update it.
The right to erasure. Individuals can request that their personal data be deleted, and we act on that request within GDPR’s required timelines this is sometimes called the “right to be forgotten.”
The right to withdraw consent. Opting in isn’t permanent. Individuals can withdraw consent at any time, and we stop processing their data accordingly.
Data is protected by design. Encryption, access controls, and secure storage aren’t add-ons — they’re built into how we handle every record, to keep personal data safe from unauthorized access or misuse.
We check our own work. Regular privacy impact assessments help us catch and fix privacy risks before they become problems not after.
Records stay accurate and purpose-bound. We keep clear documentation of our data processing activities, and we only use personal data for the purpose it was originally collected for.
Compliance isn’t a one-time checkbox. We review and update our data protection policies on an ongoing basis, so we stay aligned with GDPR as the regulation and our business evolves.