GDPR Compliance Statement

Effective Date: December 30, 2024
Data Controller: R3i Holdings Pte Limited
Platform: CodeFyx Code-as-a-Service

1. GDPR COMPLIANCE COMMITMENT

R3i Holdings Pte Limited is committed to full compliance with the General Data Protection Regulation (GDPR) for all EU residents using CodeFyx services.

2. YOUR DATA PROTECTION RIGHTS

2.1 Right of Access (Article 15)

You have the right to:

• Obtain confirmation of whether we process your personal data
• Receive a copy of your personal data in our possession
• Learn about the purposes, categories, and recipients of your data
• Understand the retention period and your other rights

How to exercise: Email privacy@codefyx.ai with "Data Access Request" in the subject line.

2.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data, including:

• Account information and contact details
• Project specifications and requirements
• Billing and subscription information

How to exercise: Update directly in your account settings or contact support.

2.3 Right to Erasure - "Right to be Forgotten" (Article 17)

You may request deletion of your personal data when:

• Data is no longer necessary for the original purpose
• You withdraw consent for processing
• Data has been unlawfully processed
• Erasure is required for legal compliance

Limitations: We may retain data for legal obligations, exercising legal claims, or protecting vital interests.

2.4 Right to Restrict Processing (Article 18)

You can request we limit processing when:

• You contest the accuracy of personal data
• Processing is unlawful but you oppose erasure
• We no longer need the data but you need it for legal claims
• You object to processing pending verification of legitimate grounds

2.5 Right to Data Portability (Article 20)

For data you provided based on consent or contract, you can:

• Receive your data in a structured, commonly used, machine-readable format
• Transmit data to another controller where technically feasible
• Export project files, specifications, and communication records

2.6 Right to Object (Article 21)

You may object to processing based on:

• Legitimate interests (we will cease unless compelling legitimate grounds exist)
• Direct marketing (we will stop immediately)
• Scientific/historical research (unless necessary for public interest)

3. LEGAL BASIS FOR PROCESSING

3.1 Contract Performance

We process data necessary to:

• Deliver coding services and manage your subscription
• Process payments and maintain billing records
• Provide customer support and project management

3.2 Legitimate Interests

We process data for:

• Platform security and fraud prevention
• Service improvement and analytics
• Business continuity and operational efficiency

3.3 Consent

We obtain explicit consent for:

• Marketing communications
• Non-essential cookies and tracking
• Newsletter subscriptions

4. DATA MINIMIZATION AND PURPOSE LIMITATION

4.1 Collection Principles

• We collect only data necessary for service delivery
• Data is used solely for stated purposes
• We regularly review data necessity
• Excessive data collection is avoided

4.2 Retention Limits

• Account data: Retained during active subscription + 90 days
• Project files: Up to 2 years for reactivation purposes
• Communication records: 3 years for support and legal compliance
• Technical logs: 12 months for security analysis

5. INTERNATIONAL TRANSFERS

5.1 Transfer Safeguards

When transferring EU personal data internationally, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available
• Additional safeguards for transfers to third countries

5.2 Service Providers

Our processors with EU data access include:

• Stripe (payment processing) - Adequate protection
• Monday.com (project management) - Standard Contractual Clauses
• AWS/Google Cloud (hosting) - Standard Contractual Clauses

6. SECURITY MEASURES

6.1 Technical Safeguards

• End-to-end encryption for data in transit and at rest
• Multi-factor authentication and access controls
• Regular security assessments and penetration testing
• Automated monitoring and intrusion detection

6.2 Organizational Measures

• Privacy by design and by default implementation
• Regular staff training on data protection
• Data protection impact assessments for new processing
• Incident response procedures for data breaches

7. CHILDREN'S DATA

CodeFyx services are not intended for individuals under 16 years of age. We do not knowingly collect or process personal data from children without parental consent.

8. AUTOMATED DECISION-MAKING

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Task assignments and service delivery involve human oversight.

9. DATA PROTECTION OFFICER

Contact our Data Protection Officer for GDPR-related matters:

• Email: dpo@codefyx.ai
• Response Time: Within 30 days of receipt
• Language: Requests accepted in English

10. SUPERVISORY AUTHORITY

EU residents have the right to lodge a complaint with their local supervisory authority if they believe their data protection rights have been violated.

11. EXERCISING YOUR RIGHTS

11.1 Request Process

1. Email privacy@codefyx.ai with your request
2. Include proof of identity (government-issued ID)
3. Specify which right you wish to exercise
4. Provide details about the data in question

11.2 Response Timeline

• Standard response: Within 30 days
• Complex requests: May extend to 60 days with notification
• Urgent requests: Expedited processing available
• Free of charge: No fees for reasonable requests

12. UPDATES TO COMPLIANCE

This GDPR compliance statement is reviewed annually and updated to reflect:

• Changes in data protection law
• New processing activities
• Enhanced security measures
• Supervisory authority guidance

Last Review: December 30, 2024
Next Review: December 30, 2025