GDPR Compliance

1. What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It gives EU residents greater control over their personal data and standardizes data protection laws across Europe.

GDPR classifies genetic data as a "special category" of personal data, requiring additional protections—which we fully implement.

2. Your Rights Under GDPR

As a user of our services, you have the following rights:

3. Legal Basis for Processing

We process your data under the following legal bases:

Explicit Consent (Article 6(1)(a) & Article 9(2)(a))

Before uploading your DNA data, you explicitly consent to its processing. You can withdraw consent at any time.

Contractual Necessity (Article 6(1)(b))

Processing is necessary to fulfill your order and deliver the services you purchased.

Legal Obligations (Article 6(1)(c))

We may retain certain data to comply with accounting and tax regulations.

4. Special Category Data

Genetic data is classified as "special category" data under GDPR Article 9. We implement additional safeguards:

• Explicit Consent: We obtain clear, affirmative consent before processing
• Data Minimization: We only process data necessary for the requested service
• Immediate Deletion: Raw DNA files are deleted immediately after processing
• No Secondary Use: We never use your genetic data for purposes beyond your request
• No Third-Party Sharing: Genetic data is never shared with third parties

5. How We Protect Your Data

6. Data Processing Agreement

We have Data Processing Agreements (DPAs) in place with all our sub-processors, including:

• Stripe: Payment processing (PCI-DSS compliant)
• PayPal: Alternative payment processing
• Cloud Hosting: EU-based servers with GDPR-compliant providers
• Email Service: For transactional emails only

7. International Transfers

We primarily process data within the European Economic Area (EEA). When transfers outside the EEA are necessary (e.g., certain payment processing), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions by the EU Commission
• Binding Corporate Rules where applicable

8. Data Protection Officer

For data protection inquiries, you can contact our Data Protection team:

Email: dpo@exploreyourdna.com

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In France, this is:

CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
Website: www.cnil.fr