GDPR & Data Protection

1. Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual necessity: processing required to deliver our services
• Legitimate interests: fraud prevention, security monitoring, product improvement
• Consent: marketing communications and optional analytics
• Legal obligation: compliance with applicable laws

2. Data Subject Rights

If you are located in the EU/EEA or other jurisdictions with similar rights, you have the following rights:

• Right of access: request a copy of data we hold about you
• Right to rectification: correct inaccurate personal data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

3. International Transfers

Your data may be processed in countries outside the EU/EEA. When we transfer data internationally, we use appropriate safeguards including Standard Contractual Clauses approved by the European Commission.

4. Data Protection Officer

Our Data Protection Officer can be contacted at dpo@gateflow.io for any GDPR-related enquiries.

5. Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority if you believe we have not complied with applicable data protection law.