GDPR Compliance

ereQa is committed to protecting the personal data of all users, including those in the European Economic Area (EEA). This page explains how we comply with the General Data Protection Regulation (GDPR).

Data Controller

ereQa Inc. acts as the Data Controller for personal data collected through our platform. Our Data Protection Officer can be reached at dpo@ereqa.com.

Lawful Basis for Processing

We process your data under the following lawful bases: (a) Contract — to provide the ereQa service you've subscribed to, (b) Consent — for optional analytics and marketing communications, (c) Legitimate Interest — for security monitoring, fraud prevention, and service improvement.

Your GDPR Rights

As an EU/EEA resident, you have the right to: access your personal data, rectify inaccurate data, erase your data ('right to be forgotten'), restrict processing, data portability (export in CSV/JSON), object to processing, and not be subject to automated decision-making. To exercise any right, email dpo@ereqa.com — we respond within 30 days.

Data Transfers

Your data may be transferred to servers outside the EEA. We ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission, and we use infrastructure providers with appropriate certifications.

Data Processing Agreements

We have signed Data Processing Agreements (DPAs) with all sub-processors who handle personal data on our behalf, including our cloud infrastructure, email delivery, and payment processing providers.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected individuals without undue delay.

Cookies

We use essential cookies required for the service to function. Non-essential cookies (analytics) are only set with your explicit consent. You can manage cookie preferences in your browser settings or through our cookie banner.

Data Retention

We retain personal data only as long as necessary for the purposes described in our Privacy Policy. Account data is deleted within 30 days of account closure. Anonymised analytics data may be retained longer.

Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.