GDPR Compliance

Our Commitment to GDPR Compliance

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to organizations processing personal data of individuals in the European Economic Area (EEA). At snug-wave.com, we are committed to full compliance with GDPR requirements and protecting the privacy rights of all our users, regardless of location.

Data Controller Information

For the purposes of GDPR, the data controller is:

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual necessity: Processing required to provide educational services you have enrolled in
• Consent: Where you have explicitly agreed to specific processing activities, such as marketing communications
• Legitimate interests: Processing necessary for our legitimate business operations, provided your rights are not overridden
• Legal obligation: Compliance with applicable laws and regulations

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right to Access

You have the right to request confirmation of whether we process your personal data and to receive a copy of that data. We will provide this information in a commonly used electronic format.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete data. We will update our records promptly upon verification of the requested changes.

Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and no other legal basis exists for processing
• You object to processing and no overriding legitimate grounds exist
• The data has been unlawfully processed
• Deletion is required for compliance with legal obligations

Note that we may retain certain data where legally required, such as financial records for tax purposes.

Right to Restriction of Processing

You may request that we limit processing of your personal data in specific circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.

Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.

Right Not to Be Subject to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently engage in automated decision-making that produces such effects.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

How to Exercise Your Rights

To exercise any of your GDPR rights, submit a request to [email protected] with the following information:

• Your full name and email address associated with your account
• Specific right you wish to exercise
• Any supporting information relevant to your request

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of the extension and reasons for delay.

Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Pseudonymization and encryption of personal data
• Regular testing and evaluation of security effectiveness
• Ongoing confidentiality, integrity, and availability of processing systems
• Ability to restore data availability after incidents
• Employee training on data protection principles

International Data Transfers

When we transfer personal data outside the EEA, we ensure adequate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Transfers to countries deemed to provide adequate protection by the European Commission
• Binding corporate rules for intra-organizational transfers

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by law.

Data Protection Officer

While we are not required to appoint a Data Protection Officer under GDPR, our privacy team oversees compliance with data protection regulations. For privacy-related inquiries, contact [email protected].

Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority in the EEA country where you reside, work, or where the alleged infringement occurred.

Changes to This Policy

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. We will notify affected users of material changes and obtain renewed consent where necessary.

Contact Information

For questions or concerns regarding GDPR compliance or to exercise your rights, contact us at: