GDPR Compliance

1. Our Commitment to GDPR

HeriWill is committed to complying with the General Data Protection Regulation (GDPR) and protecting the privacy rights of individuals in the European Union. This document outlines how we fulfill our GDPR obligations.

2. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: You have given clear consent for us to process your data
• Contract: Processing is necessary to fulfill our service agreement
• Legal Obligation: Processing is required by law
• Legitimate Interests: Processing is necessary for our legitimate business interests

3. Your Rights Under GDPR

3.1 Right to Access

You have the right to request a copy of all personal data we hold about you. We will provide this information in a commonly used electronic format within 30 days.

3.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data. We will update your information promptly upon verification.

3.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent and there's no other legal basis
• You object to processing and there are no overriding grounds
• The data has been unlawfully processed

3.4 Right to Restriction of Processing

You can request that we limit how we use your data in certain circumstances, such as when you contest the accuracy of the data.

3.5 Right to Data Portability

You can request your data in a structured, machine-readable format to transfer to another service provider.

3.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

3.7 Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing that significantly affects you.

4. How to Exercise Your Rights

To exercise any of your GDPR rights:

1. Send an email to heriwill@pledgeandgrow.com
2. Include "GDPR Request" in the subject line
3. Specify which right(s) you wish to exercise
4. Provide proof of identity for verification
5. We will respond within 30 days

5. Data Protection Measures

We implement appropriate technical and organizational measures:

• End-to-end encryption for sensitive data
• Regular security assessments and audits
• Staff training on data protection
• Access controls and authentication
• Incident response procedures
• Data minimization principles
• Privacy by design and by default

6. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

7. International Data Transfers

When transferring data outside the EU, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Binding Corporate Rules where applicable
• Additional safeguards as required

8. Data Retention

We retain personal data only for as long as necessary:

• Active accounts: Duration of service plus legal requirements
• Deleted accounts: 30 days grace period, then permanent deletion
• Legal obligations: As required by applicable law
• Backup systems: Maximum 90 days

9. Children's Data

We do not knowingly process data of individuals under 16 years of age without parental consent, in compliance with GDPR Article 8.

10. Data Protection Officer

Our Data Protection Officer oversees GDPR compliance and can be contacted at:

Email: heriwill@pledgeandgrow.com
Subject: "Attention: Data Protection Officer"

11. Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority. For France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL).

12. Updates to GDPR Compliance

We regularly review and update our GDPR compliance measures. Material changes will be communicated to all users via email.