GDPR Compliance

1. Introduction

KlarBeats is committed to compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679, which came into effect on May 25, 2018. This page outlines our GDPR compliance measures and your rights as a data subject under GDPR.

This GDPR compliance statement should be read in conjunction with our Privacy Policy, which provides detailed information about how we collect, use, and protect your personal data.

2. Our Commitment to GDPR

We are committed to protecting your personal data and ensuring compliance with GDPR. Our compliance measures include:

• Implementing appropriate technical and organizational measures to protect personal data
• Processing personal data lawfully, fairly, and transparently
• Collecting only the personal data necessary for specified purposes
• Ensuring data accuracy and keeping data up to date
• Retaining data only for as long as necessary
• Respecting and facilitating your rights as a data subject

3. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal bases:

3.1 Contractual Necessity

We process your personal data to fulfill our contractual obligations to you, such as providing the Service, processing payments, and managing your account.

3.2 Legitimate Interests

We process certain data based on our legitimate interests, such as:

• Improving and developing the Service
• Ensuring security and preventing fraud
• Providing customer support
• Complying with legal obligations

3.3 Consent

Where we rely on consent as the legal basis for processing, we will obtain your explicit consent before processing your data. You have the right to withdraw your consent at any time.

3.4 Legal Obligations

We may process your data to comply with legal obligations, such as tax requirements, data retention laws, or court orders.

4. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

4.1 Right of Access (Article 15)

You have the right to obtain confirmation as to whether or not we process your personal data and, where we do, access to that data and information about:

• The purposes of processing
• The categories of personal data concerned
• The recipients or categories of recipients
• The retention period or criteria for retention
• Your rights regarding the data

You can request a copy of your personal data by contacting us using the information provided below.

4.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete personal data completed. You can update most of your personal data directly through your account settings.

4.3 Right to Erasure - "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the original purpose
• You withdraw consent and there is no other legal basis
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

You can delete your account and associated data through your account settings or by contacting us.

4.4 Right to Restrict Processing (Article 18)

You have the right to request restriction of processing of your personal data when:

• You contest the accuracy of the data
• The processing is unlawful and you oppose erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification

4.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller. This right applies when:

• Processing is based on consent or contract
• Processing is carried out by automated means

You can request your data export through your account settings or by contacting us.

4.6 Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

4.7 Right to Withdraw Consent (Article 7)

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

4.8 Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates GDPR. In Germany, the relevant supervisory authority is:

5. Exercising Your Rights

To exercise any of your GDPR rights, please contact us using the information provided below. We will:

• Respond to your request within one month (may be extended by two months for complex requests)
• Verify your identity before processing your request
• Provide information free of charge (unless requests are manifestly unfounded or excessive)
• Explain any refusal to comply with your request and inform you of your right to lodge a complaint

6. Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: Data in transit is encrypted using TLS/SSL
• Access Controls: Strict access controls and authentication mechanisms
• Security Rules: Firebase security rules to protect database access
• Regular Updates: Regular security assessments and updates
• Audit Logs: Monitoring and logging of access and changes
• Data Minimization: Collecting only necessary data
• Retention Policies: Deleting data when no longer needed

7. Data Processing Agreements

We use the following data processors who process personal data on our behalf:

• Firebase (Google Cloud Platform): For authentication, database storage, and hosting. We have a Data Processing Agreement with Google that complies with GDPR requirements.
• Stripe: For payment processing. Stripe is GDPR compliant and processes payment data in accordance with PCI DSS standards.

All our data processors are bound by strict confidentiality obligations and GDPR-compliant data processing agreements.

8. International Data Transfers

Your data may be processed and stored in data centers located outside the European Economic Area (EEA) as part of Firebase/Google Cloud Platform services. When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Google Cloud Platform's compliance with GDPR and data protection standards
• Firebase's data processing agreements that include GDPR-compliant clauses
• Adequacy decisions where applicable

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will:

• Notify you without undue delay (within 72 hours where feasible)
• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Provide clear information about the nature of the breach and the measures we are taking
• Advise you on steps you can take to protect yourself

10. Data Protection Officer

If you have any questions, concerns, or requests regarding GDPR compliance or your data protection rights, please contact our Data Protection Officer:

11. Updates to This Statement

We may update this GDPR compliance statement from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will notify you of any material changes by posting the updated statement on this page and updating the "Last updated" date.