GDPR & International Data Compliance

1.0Roles: Controller vs. Processor Under GDPR

Under the GDPR, corporate roles and legal liabilities depend on how personal data is ingested and controlled:

2.0Lawful Bases for Processing (Article 6)

Every processing activity conducted by Migobucks is grounded in an established Article 6 lawful basis:

• Contractual Performance (Art. 6(1)(b)): Delivering software functionality, processing subscriptions, providing technical support, and fulfilling contractual SLAs.
• Legal Obligation (Art. 6(1)(c)): Retaining transaction tax records, complying with anti-fraud statutes, and cooperating with valid court orders.
• Legitimate Interests (Art. 6(1)(f)): Maintaining server network defense, preventing distributed denial-of-service (DDoS) attacks, and debugging software crashes.
• Explicit Consent (Art. 6(1)(a)): Sending specialized developer newsletters or obtaining optional mobile hardware device permissions.

3.0Data Processing Addendum (DPA) & Standard Contractual Clauses (SCCs)

For all business and enterprise clients processing EU/EEA personal data, Migobucks provides a legally binding Data Processing Addendum (DPA) that incorporates the European Commission's Standard Contractual Clauses (SCCs).

Our DPA guarantees:

• Personal data will be processed solely on documented instructions from the controller;
• All personnel authorized to process customer data have committed to strict confidentiality obligations;
• Enterprise tenants are promptly notified of any intended changes concerning sub-processors;
• Comprehensive assistance with data protection impact assessments (DPIAs) and supervisory audits.

To request an executed copy of our standard corporate DPA, your legal counsel may email dpa@migobuckstech.com.

4.0Technical & Organizational Security Measures (TOMs)

Under Article 32 of the GDPR, Migobucks implements state-of-the-art technical and organizational safeguards:

5.0Cross-Border Data Transfers & Sovereign EU Hosting

Where personal data originating in the European Economic Area (EEA) is transferred across international borders, Migobucks relies on valid legal transfer mechanisms including the European Commission's Standard Contractual Clauses (SCCs).

6.0Data Subject Rights (Articles 15–22)

We empower European data subjects to exercise their statutory rights directly:

• Right of Access (Art. 15): Obtain confirmation of whether your data is processed and receive a comprehensive data export.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten") (Art. 17): Request deletion of your personal information where processing is no longer required.
• Right to Restriction of Processing (Art. 18): Restrict processing under contested circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests or direct marketing.

7.072-Hour Security Incident & Breach Protocol

In strict compliance with Articles 33 and 34 of the GDPR, Migobucks maintains a documented Security Incident Response Protocol. In the event of a verified personal data breach:

• Our Security Operations team will notify affected enterprise Data Controllers without undue delay and within 48 hours of becoming aware;
• Where Migobucks acts as Controller, we will notify relevant European Supervisory Authorities within 72 hours unless the breach is unlikely to result in a risk to data subjects' rights;
• We provide transparent incident reports detailing the nature of the breach, affected records, mitigation measures, and recommended remedial actions.

8.0Data Protection Officer & Supervisory Inquiries

For GDPR compliance inquiries, DPA requests, or to exercise data subject rights, please contact our Data Protection Officer: