GDPR & Data Processing Agreement

Praivon is built around the General Data Protection Regulation (GDPR): we treat it not as a checkbox, but as the foundation of our service. This page summarizes our GDPR commitments and serves as a Data Processing Agreement (DPA) for our business clients (Custom plan).

1. Roles under GDPR

• Individual clients (B2C): Praivon is the data controller for your account data. For biometric data, you consent to processing under Article 9(2)(a).
• Business clients (B2B): Praivon is a data processor acting on your instructions. You remain the controller of your end users' data.

2. Data Processing Agreement (B2B)

For business clients, the following terms apply to data we process on your behalf:

Subject matter and purpose

Praivon processes the personal data you provide solely to deliver identity protection services as defined in our service agreement.

Categories of data and data subjects

• Personal identifiers (names, usernames, email addresses)
• Biometric data (reference photos and voice samples), only with the explicit consent of the data subject
• Data subjects: your employees, executives, public figures, or other identities you have authorization to protect

Sub-processors

We work with a limited number of service providers who process data on our behalf, only on our instructions and under data-processing agreements (for example hosting, payments, email delivery and customer support). Payments are handled by our secure payment provider. The current list is available to business clients on request, and you will be notified before any change. We never sell your data.

Security measures

• Your data is encrypted and access to it is strictly limited
• 72-hour breach notification per Article 33
• Sub-processor agreements binding equivalent obligations

Data subject rights

We assist you in responding to data subject requests (access, rectification, erasure, portability, restriction, objection) within 30 days, at no additional charge.

International transfers

Your data is stored in the EU. If a service provider processes data outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses or an adequacy decision. Voice data (voice protection) is processed by our voice-recognition service provider in the United States, under the Standard Contractual Clauses.

Audit rights

On reasonable notice (no more than once per year unless required by a regulator), you may audit our processing through review of our compliance documentation, or through an independent auditor.

Term and deletion

Upon termination of services, we will delete or return all personal data within 30 days, except where retention is required by law.

3. Your rights as an individual

See our Privacy Policy for the full list of rights and how to exercise them. The key rights (access, deletion, export and consent withdrawal) are available as self-service options in your dashboard.

4. Data protection contact

For any question about your personal data or your rights, write to dpo@praivon.com.

5. Supervisory authority

You have the right to lodge a complaint with the data protection authority of the EU country where you live, where you work or where the alleged infringement took place (GDPR Article 77).

6. Standard Contractual Clauses

For business clients requiring formal SCCs (e.g., for transfers outside the EU/EEA), we provide the European Commission's approved SCCs as a supplement to this DPA. Contact legal@praivon.com.