GDPR Compliance

Introduction to GDPR

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It addresses the export of personal data outside the EU and EEA areas.

At My Sparkle Story, we are committed to ensuring that all personal data processing activities comply with the GDPR. This page explains how we adhere to the GDPR principles and outlines the rights of EU citizens regarding their personal data.

Our Role Under GDPR

Under the GDPR, My Sparkle Story acts as a data controller for the personal information you provide to us. This means we determine the purposes and means of processing your personal data. We take this responsibility seriously and have implemented appropriate technical and organizational measures to ensure and demonstrate that our processing activities comply with GDPR requirements.

GDPR Principles We Follow

We adhere to the following GDPR principles when processing personal data:

• Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner.
• Purpose limitation: We collect personal data for specified, explicit, and legitimate purposes and do not process it in a manner that is incompatible with those purposes.
• Data minimization: We ensure that personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy: We take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.
• Storage limitation: We keep personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
• Integrity and confidentiality: We process personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
• Accountability: We are responsible for and can demonstrate compliance with the GDPR principles.

Legal Basis for Processing

Under the GDPR, we must have a valid legal basis for processing personal data. The legal bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for a specific purpose.
• Contract: The processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legal obligation: The processing is necessary for us to comply with the law.
• Legitimate interests: The processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.

Your Rights Under GDPR

The GDPR provides the following rights for individuals:

• Right to be informed: You have the right to be informed about the collection and use of your personal data.
• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
• Right to erasure: You have the right to have your personal data erased in certain circumstances.
• Right to restrict processing: You have the right to request the restriction or suppression of your personal data in certain circumstances.
• Right to data portability: You have the right to obtain and reuse your personal data for your own purposes across different services.
• Right to object: You have the right to object to the processing of your personal data in certain circumstances.
• Rights related to automated decision making including profiling: You have rights related to automated decision making and profiling.

How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within one month of receiving it. There is no charge for making a request, but we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

International Data Transfers

My Sparkle Story may transfer personal data to countries outside the European Economic Area (EEA). When we do so, we ensure that appropriate safeguards are in place to protect your personal data, such as:

• Standard contractual clauses approved by the European Commission
• Binding corporate rules
• Adherence to the EU-US Privacy Shield Framework (where applicable)

Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this GDPR policy and our privacy practices. If you have any questions about this policy, including any requests to exercise your legal rights, please contact our DPO using the details below:

Email: [email protected]
Address: My Sparkle Story, 123 Innovation Way, Silicon Valley, CA 94000
Phone: +1 (555) 123-4567

Data Breach Notification

In the case of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

Changes to This GDPR Policy

We may update our GDPR policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. You are advised to review this policy periodically for any changes.

Complaints

You have the right to make a complaint at any time to the supervisory authority for data protection issues in your country. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.