GDPR Compliance Policy

1. Introduction

This GDPR Compliance Policy explains how TimeHugs complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR") when processing personal data of individuals in the European Union and European Economic Area. This policy should be read together with our Privacy Policy.

2. GDPR Principles

We comply with all GDPR data protection principles:

• Lawfulness, fairness and transparency - Process personal data lawfully and transparently
• Purpose limitation - Collect data for specified, explicit and legitimate purposes
• Data minimization - Collect only data adequate and relevant for our purposes
• Accuracy - Maintain accurate personal data and update when necessary
• Storage limitation - Keep data only as long as needed for our purposes
• Integrity and confidentiality - Process data securely using appropriate measures
• Accountability - Demonstrate compliance with GDPR principles

3. Lawful Basis for Processing

We process personal data based on the following lawful bases under GDPR:

• Consent - When you explicitly agree to our processing activities
• Contract necessity - When needed to provide our messaging service to you
• Legal obligation - When required by applicable laws and regulations
• Legitimate interests - When our interests are not overridden by your rights

4. Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request access to your personal data we hold, including:

• What categories of data we process
• Purposes of processing
• Who we share your data with
• How long we store your data

Right to Rectification

You can request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data when:

• It's no longer necessary for our purposes
• You withdraw consent (if consent was the lawful basis)
• You object to processing and there's no overriding legitimate interest
• We processed your data unlawfully

Right to Restrict Processing

You can request limitation of processing when:

• You contest the accuracy of your personal data
• Processing is unlawful but you don't want erasure
• We no longer need the data but you require it for legal claims
• You've objected to processing while we verify legitimate grounds

Right to Data Portability

You can request your personal data in a structured, commonly used format when processing is based on consent or contract performance.

Right to Object

You can object to processing of your personal data when based on legitimate interests, including direct marketing.

Rights Related to Automated Decision-Making

You have rights not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

5. Exercising Your Rights

To exercise your GDPR rights:

Contact Information

• Email: privacy@timehugs.com
• Address: Smartunex OÜ, Sepapaja 6, Tallinn 15551, Estonia

Response Timeline

We will respond to your request within one month of receipt. This period may be extended by two months for complex requests. We will inform you of any extension within one month.

Information We May Need

To verify your identity and process your request, we may need:

• Proof of identity (government-issued ID)
• Specific details about your request
• Additional information to locate your personal data

6. International Data Transfers

When we transfer personal data outside the EU/EEA, we ensure appropriate safeguards:

• Adequacy decisions - To countries with EU-recognized adequate protection
• Standard contractual clauses - EU-approved contracts with data importers
• Binding corporate rules - Internal rules for intra-group transfers
• Specific safeguards - As permitted by GDPR for specific situations

7. Data Breach Notification

We have procedures to detect, investigate and report personal data breaches:

Notification to Authorities

We will notify relevant supervisory authorities within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in risks to individuals' rights and freedoms.

Notification to Individuals

We will notify affected individuals without undue delay when the breach is likely to result in high risks to their rights and freedoms, including:

• Potential identity theft or fraud
• Financial loss
• Discrimination
• Reputation damage
• Other significant economic or social disadvantage

8. Data Protection Officer

While not required under GDPR for our current scale of operations, we have designated personnel responsible for data protection compliance who can be contacted at privacy@timehugs.com.

9. Cookies and Tracking Technologies

Our use of cookies and tracking technologies complies with GDPR requirements:

• Essential cookies - Required for our service to function
• Performance cookies - Help us understand how our service is used
• Functional cookies - Enable enhanced functionality and personalization
• Marketing cookies - Used with your explicit consent only

You can control cookie preferences through your browser settings and our cookie consent banner.

10. Children's Data

We do not knowingly process personal data of children under 16 years old without parental consent. If we learn we have collected such data without consent, we will delete it promptly.

11. Updates to This Policy

We may update this GDPR Compliance Policy to reflect changes in our practices, legal requirements, or GDPR guidance. We will notify individuals of significant changes as required by GDPR.

12. Contact Information

For GDPR-related questions, concerns, or to exercise your rights:

Data Protection Contact

• Email: privacy@timehugs.com
• Address: Smartunex OÜ, Sepapaja 6, Tallinn 15551, Estonia
• Registration: Smartunex OÜ, 17283605

Supervisory Authority

If you believe we have violated your GDPR rights, you have the right to lodge a complaint with your local supervisory authority.

---

This GDPR Compliance Policy is issued by Smartunex OÜ, a private limited company registered in Estonia under registration number 17283605.