GDPR Compliance
Understanding and exercising your data protection rights under the General Data Protection Regulation
Your Data Protection Rights
You have the right to obtain confirmation whether we process your personal data and access to that data.
How to exercise:
Submit a data access request through your account settings or email privacy@norma-ai.com
You have the right to obtain the rectification of inaccurate personal data concerning you.
How to exercise:
Update your data directly in your profile settings or contact us for assistance.
You have the right to obtain the erasure of your personal data in certain circumstances.
How to exercise:
Request deletion through your account settings or email privacy@norma-ai.com
You have the right to obtain the restriction of processing in certain circumstances.
How to exercise:
Contact us to request restriction of processing of your data.
You have the right to receive your data in a structured, commonly used and machine-readable format.
How to exercise:
Export your data from your account settings or request a complete export.
You have the right to object to the processing of your personal data for reasons relating to your particular situation.
How to exercise:
Contact us at privacy@norma-ai.com specifying the processing you object to.
Lawful Bases for Processing
Under GDPR, we must have a lawful basis for processing your personal data. Here are the bases we rely on:
Examples:
- Account creation and management
- Service delivery
- Payment processing
Examples:
- Tax records
- Anti-money laundering checks
- Court orders
Examples:
- Service improvements
- Security and fraud prevention
- Direct marketing (with opt-out)
Examples:
- Marketing emails
- Analytics cookies
- Newsletter subscriptions
Categories of Data We Process
| Category | Examples | Retention Period |
|---|---|---|
| Identity Data | Name, username, title | Duration of account + 30 days |
| Contact Data | Email, phone, address | Duration of account + 30 days |
| Financial Data | Payment info, transaction history | 7 years (legal requirement) |
| Technical Data | IP address, browser data, logs | 90 days |
| Usage Data | Service usage, preferences | 24 months |
| Document Data | Uploaded documents, analysis results | Duration of account + 90 days |
International Data Transfers
When we transfer your data outside the EEA, we ensure appropriate safeguards:
Standard Contractual Clauses (SCCs)
We use EU Commission-approved SCCs for transfers to countries without adequacy decisions.
Adequacy Decisions
We prefer transfers to countries with EU adequacy decisions (UK, Switzerland, Canada, etc.).
Technical Measures
All transfers use encryption and secure protocols to protect your data in transit.
How to Exercise Your Rights
Online Request
The fastest way to exercise your rights is through your account settings:
- 1. Log in to your account
- 2. Go to Settings → Privacy
- 3. Select the right you want to exercise
- 4. Follow the instructions
Email Request
You can also submit requests via email to our Data Protection Officer:
privacy@norma-ai.com
Response within 30 days
Please include your account email and specific request. We may need to verify your identity.
Data Breach Notification
In the unlikely event of a data breach that poses a high risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours
- Inform you without undue delay if there's a high risk to your rights
- Provide clear information about the breach and its potential impact
- Recommend actions you can take to protect yourself
Your Right to Complain
If you're not satisfied with how we handle your data or respond to your requests, you have the right to lodge a complaint with a supervisory authority.
Lead Supervisory Authority
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin, Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
You can also contact your local data protection authority. Find your local authority at edpb.europa.eu