GDPR Compliance

1. Our commitment to GDPR

Burrak AI is committed to protecting the privacy and rights of individuals in the European Economic Area (EEA), the United Kingdom, and other regions with similar laws. This page explains how we comply with the General Data Protection Regulation (GDPR) and the rights it gives you. It supplements our Privacy Policy.

2. Controller and processor roles

When you use Burrak AI as a customer, you are generally the data controller for the personal data you submit, and we act as a data processor that processes that data on your behalf and according to your instructions. For information we collect about our own account holders and website visitors, Burrak AI acts as the data controller.

3. Legal bases for processing

We process personal data only where we have a valid legal basis, including:

• Performance of a contract, to provide the Services you request.
• Consent, which you may withdraw at any time.
• Legitimate interests, such as securing and improving the Services, balanced against your rights.
• Legal obligation, where processing is required to comply with the law.

4. Your rights under GDPR

If you are in the EEA or UK, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to certain processing of your data.
• Receive your data in a portable, machine-readable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

5. How to exercise your rights

To exercise any of these rights, contact us at privacy@burrakai.com. We will respond within the timeframes required by law, normally within one month. We may need to verify your identity before fulfilling your request. There is no fee unless your request is manifestly unfounded or excessive.

6. Data processing agreement

Customers who require a Data Processing Agreement (DPA) to govern our processing of personal data on their behalf can request one by contacting us. Our DPA includes the standard contractual clauses where appropriate for international data transfers.

7. International data transfers

Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses, to ensure your data receives an adequate level of protection.

8. Subprocessors

We use vetted third-party subprocessors to help deliver the Services, such as cloud hosting and payment providers. We require subprocessors to provide appropriate safeguards for personal data. A current list of subprocessors is available on request.

9. Data protection contact

For any GDPR-related questions or to exercise your rights, contact our data protection team at privacy@burrakai.com. You also have the right to contact your local supervisory authority.