Privacy Policy

1. Data Controller & Lawful Basis

NexGen DAM Inc. (controller ID: DE-123456) processes personal data under GDPR Art. 6(1)(b) for contract performance and Art. 6(1)(f) for legitimate interest. We store only metadata required for asset management: user ID, timestamps, and action logs.

2. Data Categories & Retention

• Account data: retained 3 years post-account closure
• Usage logs: anonymized after 90 days
• Asset metadata: kept for duration of storage contract

3. Third-Party Disclosures

We sub-process data with: AWS (US-East, GDPR DPA); Cloudflare (CDN, standard contractual clauses). No third-party analytics cookies are deployed. Data remains within EEA unless explicit consent given.

4. Data Subject Rights

Access, rectification, erasure via GDPR Art. 15-21. Submit requests to [email protected]. Response within 30 days. We do not sell data under CCPA.

5. Security Measures

AES-256 encryption at rest, TLS 1.3 in transit. Annual penetration tests by NCC Group. Employee access follows least-privilege principle.