# GDPR Compliance

**Last Updated:** {{effective_date}}
**Version:** {{version}}

## 1. Introduction

General Bots is committed to protecting the privacy and personal data of individuals in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page explains how we comply with GDPR requirements and outlines your rights as a data subject.

## 2. Our Role Under GDPR

### 2.1 As a Data Controller

When we collect and process personal data for our own purposes (e.g., managing customer accounts, marketing), we act as a **Data Controller**.

### 2.2 As a Data Processor

When we process personal data on behalf of our customers through our platform, we act as a **Data Processor**. Our customers remain the Data Controllers for such data.

## 3. Lawful Basis for Processing

We process personal data based on the following lawful bases:

| Purpose | Lawful Basis |
|---------|--------------|
| Providing our services | Contract performance |
| Account management | Contract performance |
| Customer support | Contract performance / Legitimate interests |
| Service improvement | Legitimate interests |
| Security and fraud prevention | Legitimate interests / Legal obligation |
| Marketing communications | Consent |
| Legal compliance | Legal obligation |

## 4. Your Rights Under GDPR

As a data subject, you have the following rights:

### 4.1 Right of Access (Article 15)

You have the right to:
- Obtain confirmation of whether we process your personal data
- Access your personal data
- Receive information about how your data is processed

**How to exercise:** Submit a Subject Access Request through your account settings or contact privacy@generalbots.ai.

### 4.2 Right to Rectification (Article 16)

You have the right to:
- Correct inaccurate personal data
- Complete incomplete personal data

**How to exercise:** Update your information in account settings or contact us directly.

### 4.3 Right to Erasure / Right to be Forgotten (Article 17)

You have the right to request deletion of your personal data when:
- The data is no longer necessary for its original purpose
- You withdraw consent (where consent was the basis)
- You object to processing and there are no overriding legitimate grounds
- The data was unlawfully processed
- Deletion is required by law

**How to exercise:** Use the "Delete My Data" feature in account settings or contact privacy@generalbots.ai.

**Limitations:** We may retain data where required by law or for legitimate business purposes.

### 4.4 Right to Restriction of Processing (Article 18)

You have the right to restrict processing when:
- You contest the accuracy of your data
- Processing is unlawful but you prefer restriction over erasure
- We no longer need the data but you need it for legal claims
- You have objected to processing pending verification

**How to exercise:** Contact privacy@generalbots.ai with your specific request.

### 4.5 Right to Data Portability (Article 20)

You have the right to:
- Receive your personal data in a structured, commonly used, machine-readable format
- Transmit your data to another controller

**How to exercise:** Use the "Export My Data" feature in account settings.

**Format:** Data is provided in JSON format.

### 4.6 Right to Object (Article 21)

You have the right to object to:
- Processing based on legitimate interests
- Processing for direct marketing purposes
- Processing for research or statistical purposes

**How to exercise:** Contact privacy@generalbots.ai or use unsubscribe links in marketing emails.

### 4.7 Rights Related to Automated Decision-Making (Article 22)

You have the right to:
- Not be subject to decisions based solely on automated processing
- Obtain human intervention
- Express your point of view
- Contest automated decisions

**Our approach:** We do not make solely automated decisions that significantly affect you without human oversight.

## 5. How to Exercise Your Rights

### 5.1 Contact Information

**Data Protection Contact:**
- Email: privacy@generalbots.ai
- Address: [Company Address]

### 5.2 Response Time

We will respond to your request within **30 days**. If your request is complex, we may extend this by an additional 60 days (we will notify you).

### 5.3 Verification

To protect your data, we may need to verify your identity before processing your request.

### 5.4 No Fee

Exercising your rights is generally free. We may charge a reasonable fee for manifestly unfounded or excessive requests.

## 6. Data Protection Measures

### 6.1 Technical Measures

- **Encryption:** TLS 1.3 for data in transit, AES-256 for data at rest
- **Access Controls:** Role-based access, multi-factor authentication
- **Monitoring:** 24/7 security monitoring and intrusion detection
- **Backups:** Regular encrypted backups with secure storage

### 6.2 Organizational Measures

- **Privacy by Design:** Data protection built into our systems
- **Employee Training:** Regular data protection training
- **Vendor Assessment:** Due diligence on all sub-processors
- **Incident Response:** Documented breach response procedures

## 7. International Data Transfers

### 7.1 Transfer Mechanisms

When transferring personal data outside the EEA, we use:
- **Standard Contractual Clauses (SCCs)** approved by the European Commission
- **Adequacy Decisions** where applicable
- **Binding Corporate Rules** for intra-group transfers

### 7.2 Supplementary Measures

We implement additional safeguards including:
- End-to-end encryption
- Pseudonymization where possible
- Data minimization practices
- Regular transfer impact assessments

## 8. Data Breach Procedures

### 8.1 Detection and Assessment

We maintain systems to detect and assess potential data breaches promptly.

### 8.2 Notification to Supervisory Authority

We will notify the relevant supervisory authority within **72 hours** of becoming aware of a breach that is likely to result in a risk to individuals' rights and freedoms.

### 8.3 Notification to Data Subjects

Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

## 9. Data Protection Officer

While not required in all cases, we maintain a data protection function that can be reached at:

**Email:** dpo@generalbots.ai

## 10. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

**Lead Supervisory Authority:**
[Relevant Authority Name and Contact Details]

**Your Local Authority:**
You may also contact your local data protection authority.

## 11. Children's Data

Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

## 12. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risks to individuals, including:
- Large-scale processing of special categories of data
- Systematic monitoring of publicly accessible areas
- Automated decision-making with legal effects

## 13. Record of Processing Activities

In accordance with Article 30 of GDPR, we maintain a record of processing activities, including:
- Categories of data subjects and personal data
- Purposes of processing
- Recipients of personal data
- International transfers
- Retention periods
- Security measures

## 14. Sub-Processors

We use sub-processors to help provide our services. A current list of sub-processors is available in our Data Processing Agreement. We ensure all sub-processors provide equivalent data protection guarantees.

## 15. Updates to This Page

We may update this GDPR compliance information from time to time. We will notify you of significant changes through our services or by email.

## 16. Contact Us

For any questions about GDPR compliance or to exercise your rights:

**Email:** privacy@generalbots.ai
**Address:** [Company Address]
**Response Time:** Within 30 days

---

*This GDPR compliance page is provided as a template and should be customized for your specific circumstances. We recommend consulting with a qualified data protection professional or legal counsel to ensure full compliance with GDPR requirements.*