GDPR Compliance

Article 6(1)(b) — Performance of a Contract

This is our primary lawful basis. We process your data to fulfill our contractual obligations to you as a user of the Service. This covers: creating and managing your account, running scans against data brokers, submitting removal requests on your behalf, generating professional content at your request, sending transactional emails (scan results, billing), and processing payments.

Article 6(1)(f) — Legitimate Interests

We process usage analytics and security logs based on our legitimate interests in: improving the quality and security of our service, detecting and preventing fraud and abuse, and understanding how our platform is used at an aggregate level. We have conducted and documented a Legitimate Interests Assessment (LIA) confirming that these interests are not overridden by your rights and freedoms, given the limited and non-intrusive nature of this data processing.

Article 6(1)(a) — Consent

We rely on consent for: sending marketing or promotional emails (you can opt out at any time via the unsubscribe link), any optional cookies beyond strictly necessary ones (currently none), and processing any sensitive data categories that may arise during scans (e.g., if a data broker has published information about your health or political views). Consent is freely given, specific, informed, and unambiguous. You may withdraw it at any time without affecting prior lawful processing.

Article 6(1)(c) — Legal Obligation

We process and retain certain data to comply with legal obligations, including: retaining financial and transaction records for EU VAT and tax compliance (typically 7 years), responding to lawful requests from law enforcement or regulatory authorities, and maintaining audit logs required by applicable Irish law.

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data along with information about: the purposes of processing, the categories of data, recipients or categories of recipients, the retention period, your other rights, the right to lodge a complaint, and the source of the data if not collected from you directly.

You have the right to request correction of inaccurate personal data and completion of incomplete data. This is particularly important given that our service involves personal data — if a scan result incorrectly attributes data to you, you have the right to have that corrected in our systems.

You have the right to request deletion of your personal data when: the data is no longer necessary for its original purpose; you withdraw consent (where processing was based on consent); you object and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required by EU or Irish law. Erasure may be refused where processing is necessary for legal obligations or for the establishment, exercise, or defense of legal claims.

You have the right to restrict our processing of your data while: the accuracy is being contested; the processing is unlawful but you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected and we are verifying whether our legitimate grounds override yours. During restriction, we store but do not otherwise process your data.

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON), and to transmit that data to another controller. This applies to: account information, scan results, removal request history, and generated content.

You have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f)) or processing for direct marketing purposes. On receipt of an objection to legitimate interest processing, we must cease unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects concerning you. NOXRID does not make automated decisions with legal effects about users. Our tools present information to you; all significant decisions are human-reviewed.

EU-US Data Privacy Framework (DPF)

Stripe is certified under the EU-US Data Privacy Framework, which the European Commission recognized as providing an adequate level of data protection in its adequacy decision of July 10, 2023. We rely on this adequacy decision for transfers to Stripe.

Standard Contractual Clauses (SCCs)

For processors not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021 version, incorporating the EU-US transfer supplement where applicable). SCCs are incorporated into our DPAs with Anthropic, Vercel, and Render.

Supplementary Measures

Where required by our Transfer Impact Assessments (TIAs), we implement supplementary technical measures including: end-to-end encryption, data minimization (sending only what is necessary for each processing purpose), and pseudonymization before transfer where technically feasible.

Notification to Supervisory Authority (Art. 33)

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the Irish Data Protection Commission (DPC) within 72 hours of becoming aware of the breach. The notification will include: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate number of records affected, likely consequences, and measures taken or proposed to address the breach.

Notification to Data Subjects (Art. 34)

Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the breach to affected data subjects 'without undue delay'. The communication will include a plain-language description of the nature of the breach, contact details of our DPO, likely consequences, and the measures we have taken to address the breach and mitigate its adverse effects.

Internal Breach Register

We maintain an internal record of all personal data breaches, including those that do not reach the threshold for external notification, as required by Article 33(5). This register is reviewed regularly by our DPO and used to improve our security posture.

Response Timeline

Our incident response plan mandates: immediate (within 1 hour) escalation to the security team on breach discovery; containment and initial assessment within 24 hours; DPC notification within 72 hours if required; user notification as rapidly as technically feasible once the extent of impact is determined, and in all cases before significant harm can occur.

Data Minimization

We collect and process only the personal data that is strictly necessary for each defined purpose. Our data model is reviewed at design time to challenge every field: is this necessary? Can we achieve the same goal with less?

Purpose Limitation

Data collected for one purpose is not reprocessed for another incompatible purpose. Our engineering standards include data access controls that prevent cross-purpose data flows at a system level.

Storage Limitation

Automated data retention policies delete personal data once its retention period expires. Our deletion jobs run daily and are monitored for failures.

Default Privacy

The most privacy-protective settings are the default. For example, marketing emails are off by default (opt-in only), and optional data sharing features require explicit activation.

Encryption by Default

All data is encrypted at rest (AES-256) and in transit (TLS 1.3) as a baseline requirement, not an optional configuration.

Access Control by Default

Role-based access control (RBAC) means employees can only access personal data categories required for their specific role. Access to production data requires explicit approval and audit logging.

Pseudonymization

Where possible, we pseudonymize personal data in analytical pipelines, separating identifying information from the data being analyzed.

Privacy in Development

Our engineering team follows a Privacy Engineering checklist for every pull request that touches personal data. Privacy impact is assessed before code is merged, not after deployment.

Irish Data Protection Commission (Lead Authority)

Your National DPA

Users in other EU member states may also contact their national supervisory authority. A full list of EU data protection authorities is available at edpb.europa.eu.