GDPR Compliance

1. What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all organizations that process personal data of individuals located in the European Economic Area (EEA), regardless of where the organization is based.

GDPR strengthens data protection rights for individuals and imposes strict obligations on organizations that process personal data. It aims to give individuals more control over their personal data and ensure that organizations handle data responsibly and transparently.

2. Our Role Under GDPR

2.1 Data Controller

Tuco.ai acts as a data controller when we determine the purposes and means of processing your personal data, such as:

• Managing your account and providing our services
• Processing payments and billing
• Communicating with you about our services
• Marketing and promotional activities (with your consent)
• Legal compliance and security

2.2 Data Processor

Tuco.ai acts as a data processor when we process personal data on behalf of our customers (data controllers) in connection with our iMessage automation services. In this capacity, we:

• Process data only as instructed by our customers
• Implement appropriate technical and organizational measures
• Assist customers in fulfilling their GDPR obligations
• Maintain records of processing activities

3. Legal Basis for Processing

Under GDPR, we process your personal data based on one or more of the following legal bases:

4. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

5. How to Exercise Your Rights

To exercise any of your GDPR rights, you can:

• Email us: privacy@tuco.ai
• Contact our DPO: dpo@tuco.ai
• Use self-service features: Access your account settings for data export, deletion, and preferences
• Write to us: Tuco.ai, 8 The Green, STE R, Dover, DE 19901, USA, Attn: Data Protection Officer

We will respond to your request within one month (or two months for complex requests). We may ask you to verify your identity before processing your request.

6. Data Processing Principles

We adhere to GDPR's core data processing principles:

• Lawfulness, Fairness, and Transparency: We process data lawfully, fairly, and transparently.
• Purpose Limitation: We collect data for specified, explicit, and legitimate purposes.
• Data Minimization: We only collect data that is necessary for our purposes.
• Accuracy: We keep data accurate and up-to-date.
• Storage Limitation: We retain data only for as long as necessary.
• Integrity and Confidentiality: We implement appropriate security measures to protect data.
• Accountability: We are responsible for demonstrating compliance with GDPR.

7. Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access controls and authentication mechanisms
• Regular Audits: Security assessments and vulnerability testing
• Data Backup: Regular backups with secure storage
• Employee Training: Regular training on data protection and security
• Incident Response: Procedures for detecting, reporting, and responding to data breaches
• Secure Infrastructure: Hosting in secure, compliant data centers

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk
• Provide clear information about the nature of the breach, likely consequences, and measures taken
• Document all breaches and our response

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the EEA. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs): Approved by the European Commission
• Adequacy Decisions: Transfers to countries with adequacy decisions
• Binding Corporate Rules: Where applicable
• Other Safeguards: Additional measures as required by GDPR

You can request information about the specific safeguards we use for international transfers by contacting us.

10. Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) to oversee our GDPR compliance. You can contact our DPO for:

• Questions about our data processing activities
• Exercising your GDPR rights
• Reporting concerns about data protection
• Requesting information about our compliance measures

11. Supervisory Authority

If you are located in the EEA, you have the right to lodge a complaint with your local supervisory authority if you believe we have violated GDPR. You can find your supervisory authority at:

• European Data Protection Board (EDPB)
• List of EU Data Protection Authorities

We encourage you to contact us first at privacy@tuco.ai so we can address your concerns.

12. Data Processing Records

As required by GDPR Article 30, we maintain records of our processing activities, including:

• Purposes of processing
• Categories of data subjects and personal data
• Categories of recipients
• Transfers to third countries
• Retention periods
• Security measures

13. Updates to This Page

We may update this GDPR compliance page from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by updating the "Last updated" date and, where appropriate, notifying you via email or through our services.

14. Contact Us

For questions, concerns, or requests regarding GDPR compliance, please contact us:

15. Additional Resources

• Privacy Policy - Our complete privacy policy
• Data Deletion Instructions - How to request data deletion
• Terms of Service - Our terms and conditions
• GDPR.eu - Official GDPR information
• European Commission - Data Protection - Official EU resources