Our GDPR commitments
Lawful basis for all processing
Every piece of personal data we process has a documented lawful basis: contract, legitimate interests, legal obligation, or explicit consent.
Data minimisation
We only collect data that is necessary for the stated purpose. We do not collect personal data speculatively.
Records of processing activities
We maintain a full Register of Processing Activities (ROPA) as required by Article 30 GDPR.
International transfer safeguards
All transfers of EU/UK personal data to third countries are protected by Standard Contractual Clauses (SCCs).
Breach notification
In the event of a data breach, we will notify affected customers and supervisory authorities within 72 hours.
Data Protection Officer
We have appointed a Data Protection Officer (DPO). Contact: dpo@repaircorex.com.
1. Overview
The General Data Protection Regulation (GDPR) is a European Union regulation that governs how organisations collect, use, and protect personal data about EU and UK residents.
RepairCoreX Technologies Ltd is fully committed to GDPR compliance — both as a data controller (for data about our own customers) and as a data processor (for the Business Data our customers enter into our platform).
2. Controller vs. Processor
As a data controller: RepairCoreX controls data about our own customers — contact details, billing information, usage data. We make independent decisions about why and how to use this data.
As a data processor: When you use RepairCoreX to manage your customers' data (names, contact details, device records, etc.), you are the data controller and RepairCoreX is your data processor. We process that data only on your documented instructions.
Our Data Processing Agreement (DPA) — included in our Terms of Service — governs our role as your processor. Contact legal@repaircorex.com to request a signed DPA.
3. Data Processing Agreement
Our DPA is incorporated into our Terms of Service and is automatically in place when you use RepairCoreX.
The DPA covers: lawful bases for processing, sub-processor management, security measures, data breach notification, data subject rights, and transfer mechanisms.
If your organisation requires a separately signed DPA (for compliance or audit purposes), contact legal@repaircorex.com.
4. Technical & Organisational Security Measures
Encryption: AES-256 at rest for all stored data; TLS 1.3 in transit.
Access controls: Role-based access control (RBAC); principle of least privilege; MFA enforced for all RepairCoreX staff.
Infrastructure: SOC 2 Type II certified hosting (AWS); automated backups with 30-day retention; disaster recovery tested quarterly.
Staff training: All employees complete annual GDPR awareness and security training.
Penetration testing: Annual third-party penetration testing of the platform.
Incident response: Documented incident response plan with 72-hour breach notification commitment.
5. International Data Transfers
RepairCoreX stores EU and UK customer data in AWS eu-west-1 (Ireland) by default.
Some sub-processors (Stripe, Twilio, Intercom) are based in the US. Transfers to these providers are protected by EU Standard Contractual Clauses (SCCs) approved by the European Commission.
For UK customers, we rely on the UK ICO's International Data Transfer Agreement (IDTA) for transfers to the US.
6. Complaints and Supervisory Authority
If you believe your GDPR rights have been violated, you can contact our DPO at dpo@repaircorex.com. We will investigate and respond within 30 days.
You also have the right to lodge a complaint with your national supervisory authority:
UK: Information Commissioner's Office (ICO) — ico.org.uk
Ireland: Data Protection Commission (DPC) — dataprotection.ie
Germany: Federal Commissioner for Data Protection (BfDI) — bfdi.bund.de
France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr
Your rights under GDPR
Right of access
You can request a copy of all personal data we hold about you.
How to exercise
Email privacy@repaircorex.com with subject "Data Access Request"
Our response time
Response within 30 days
Right to rectification
You can request correction of inaccurate or incomplete personal data.
How to exercise
Update directly in your account settings, or email us
Our response time
Response within 30 days
Right to erasure
You can request deletion of your personal data ('right to be forgotten'), subject to legal retention obligations.
How to exercise
Email privacy@repaircorex.com with subject "Erasure Request"
Our response time
Completed within 30 days
Right to restriction
You can request that we restrict the processing of your personal data in certain circumstances.
How to exercise
Email privacy@repaircorex.com
Our response time
Response within 30 days
Right to data portability
You can receive your personal data in a structured, machine-readable format (JSON or CSV).
How to exercise
Use the Export function in Settings > Privacy, or email us
Our response time
Export available within 7 days
Right to object
You can object to processing based on legitimate interests or for direct marketing at any time.
How to exercise
Click "Unsubscribe" in emails, or email privacy@repaircorex.com
Our response time
Immediate for marketing; within 30 days for other objections
Approved sub-processors
As your data processor, we are transparent about which sub-processors we use to deliver our service. We will notify you at least 30 days before adding new sub-processors.
Sub-processor
Purpose
Location
Safeguard
Amazon Web Services (AWS)
Cloud infrastructure and storage
US (EU/UK data in EU-WEST-1)
AWS DPA
Stripe
Payment processing
US
Stripe DPA + SCCs
Twilio
SMS notifications
US
Twilio DPA + SCCs
Intercom
Customer support chat
US
Intercom DPA + SCCs
Postmark
Transactional email delivery
US
Postmark DPA + SCCs
Posthog
Product analytics
EU (EU cloud)
Posthog DPA
Need a signed DPA?
If your compliance or procurement team requires a separately signed Data Processing Agreement, we can provide one within 3 business days.
Request a signed DPA →