GDPR

1. What GDPR is

The General Data Protection Regulation, or GDPR, is the data protection law of the European Union and the United Kingdom. It has applied since 2018 and gives individuals rights over their own personal data, such as seeing, correcting, or deleting it, while requiring the organizations that handle that data to do so transparently and securely.

GDPR applies to any organization that processes the personal data of people in the EU or the UK, regardless of where that organization itself is based, which is why Gezora publishes this page even though we are not headquartered there.

2. How Gezora approaches GDPR

Gezora's data practices are built around GDPR's core principles as standard practice, not as a late addition. Our terms and conditions and privacy policy reflect these commitments, and the same controls described on this page, encryption, access restrictions, and data subject rights, apply to how we handle personal data for customers in the EU and the UK.

3. Our role in processing your data

When we process business data on your behalf to run a deployed agent, we act as a processor working to your instructions. When you contact us directly as a prospect or a customer, we act as a controller for the contact details you give us.

4. Data we collect

Gezora collects the contact details you give us directly, the business data processed through the agents we deploy for you, and the technical and usage information needed to operate, secure, and support the service. The full breakdown of what we collect is in our privacy policy.

5. Why we collect your data

We collect this information to deliver and support the services you have engaged us for, to communicate with you about your deployment, and to keep our systems secure and reliable.

6. Data subject rights

Our controls support the following rights the GDPR recognizes for individuals:

• ›Access the personal data we hold about them.
• ›Correct inaccurate personal data.
• ›Have their personal data deleted, subject to what we need to keep for an active engagement or a legal obligation.
• ›Restrict or object to certain processing.
• ›Receive their data in a portable format.

7. How to exercise your rights

Send a request to our team and we will route it to the right person. We aim to confirm receipt promptly and respond within a reasonable time, consistent with our contractual and legal obligations.

8. Data processing agreements and sub processors

A data processing addendum is available on request for customers who need one, and we will share our current sub processor list on request as well.

9. Security of your data

Data in transit and at rest is encrypted, and our controls align with SOC 2 Trust Services Criteria and support GDPR and HIPAA requirements. Administrative access requires multi factor authentication and follows least privilege.