GDPR Policy

1. Introduction

This GDPR Policy supplements our Privacy Policy and describes how Denkora ("we," "us," "our") complies with the EU General Data Protection Regulation (GDPR) and the UK GDPR for Users located in the European Economic Area (EEA) and the United Kingdom.

2. Definitions

Terms used in this Policy (Personal Data, Processing, Data Subject, Controller, Processor) have the meanings given under Article 4 of the GDPR.

3. Roles

Denkora acts as the Data Controller for Personal Data collected directly through the Services, and as a Data Processor in limited circumstances where we process data on behalf of business or enterprise Users (e.g., data uploaded about a User's own contacts or team).

4. Legal Bases for Processing

We process Personal Data under the following Article 6 GDPR legal bases:

• Consent (Art. 6(1)(a)) — marketing communications, non-essential cookies
• Contract (Art. 6(1)(b)) — providing the Services you sign up for
• Legal obligation (Art. 6(1)(c)) — regulatory, tax, and compliance requirements
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, product improvement, and business analytics, balanced against your rights and interests

5. Data Subject Rights

Under GDPR/UK GDPR, you have the right to:

• Access your Personal Data
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to legal exceptions
• Restrict Processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to Processing based on legitimate interests or for direct marketing
• Withdraw consent at any time, without affecting prior lawful Processing
• Not be subject to solely automated decision-making producing legal or similarly significant effects, without human review (see Section 8)

Requests can be submitted using the contact details in Section 10. We aim to respond within one month, extendable by two further months for complex requests, as permitted under Article 12(3).

6. International Data Transfers

Where Personal Data is transferred outside the EEA/UK, we rely on one or more of the following safeguards:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs
• Other legally recognized transfer mechanisms

7. Data Protection Officer / Privacy Contact

Denkora has designated a privacy contact responsible for GDPR compliance matters.

8. Automated Decision-Making and AI

Denkora uses AI Features for recommendations, matching, and search ranking. These do not produce legal or similarly significant effects on Users without the option for human review. Where automated processing meaningfully affects your access to the Platform (e.g., account suspension decisions materially based on automated fraud detection), you may request human review. See our AI Usage & Transparency Policy for further detail.

9. Data Breach Notification

In the event of a Personal Data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware, where required, and will notify affected Users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

10. Complaints and Contact

You have the right to lodge a complaint with your local data protection supervisory authority. Before doing so, we encourage you to contact us first:

Denkora — Privacy Team
Email: [email protected]

11. Changes to This Policy

We may update this Policy to reflect regulatory or operational changes. Material updates will be communicated via the Platform.