We process personal data only when we have a lawful basis to do so under GDPR Article 6:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for a contract we have with you
• Legal Obligation: Processing is necessary for us to comply with the law
• Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party

Under GDPR, you have the following rights:

• Right to Access: Request access to your personal data
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your personal data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing

We adhere to the GDPR data protection principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and in a transparent manner
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes
• Data Minimization: We collect only the data that is adequate, relevant, and necessary
• Accuracy: We ensure personal data is accurate and kept up to date
• Storage Limitation: We retain data only as long as necessary
• Integrity and Confidentiality: We process data securely with appropriate technical and organizational measures

When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Your explicit consent for the transfer

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.

We take data protection seriously. For any GDPR-related inquiries or to exercise your rights, please contact us through our contact page.

To exercise any of your GDPR rights:

• Contact us through our Contact page
• We will respond to your request within one month
• We may request identification to verify your identity
• You have the right to lodge a complaint with your local supervisory authority

Where we rely on consent as the legal basis for processing:

• We obtain clear and affirmative consent
• You can withdraw consent at any time
• Withdrawal of consent will not affect the lawfulness of processing before withdrawal
• We maintain records of consent obtained

For website analytics specifically, we present a cookie consent banner on your first visit and use Google Consent Mode v2. We use Google Analytics, loaded through Google Tag Manager, with Google acting as a data processor on our behalf. For visitors in the European Union, the European Economic Area, and the United Kingdom, analytics storage stays denied by default and loads only after you accept it through the banner. You can decline, or change your mind later, and analytics will not run. See our Cookie Policy for the specific cookies and their retention.