AxiomTrak – Privacy Policy

AxiomTrak (the “Platform”, “Service”, “we”, “us”, “our”) is a Vilnius‑based compliance‑automation solution.

This Privacy Policy explains how we collect, use, store, share, and protect personal data in accordance with the EU General Data Protection Regulation (GDPR), the EU AI Act, the Brazilian LGPD, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and any other applicable law.

1. Definitions

Legal frameworks referenced: GDPR (EU/EEA/UK/CH), EU AI Act, LGPD (Brazil), CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah).

2. Roles

3. What Data We Collect

4. Legal Basis & Purpose

Legal‑Basis Matrix (see Section 5 table).

Specific Purposes

• Provision of Automated Compliance Documentation – generate, store, and deliver compliance reports for each AI model.
• Continuous Dynamic Policy Updates – push regulatory changes to the user dashboard; require manual “User Acceptance” before integration.
• Compliance with the EU AI Act & other sectoral regulations – maintain records, audit trails, and evidence of compliance.
• Security & Fraud Prevention – detect abnormal activity, protect accounts, and safeguard platform integrity.
• Service Improvement & Product Development – analyse aggregated, anonymised usage statistics to enhance features (no personal data used for AI‑training without consent).
• Legal & Regulatory Obligations – retain records for tax, accounting, and possible litigation (up to six years).
• Customer Support – answer queries, troubleshoot issues, and provide technical assistance.
• Communications – send service‑related announcements, security alerts, and, where consented, marketing material.

Data Minimisation Principles

• Review Cycle – Every 12 months we audit each data field against the purpose list. Unused fields are removed.
• Deletion on Request – Data subjects may request erasure of any data that is no longer necessary for the original purpose.
• Purpose‑Specific Storage – Data collected for a specific purpose is stored in a dedicated database schema that is not reused for unrelated processing.

5. How We Collect Data

All transmissions use TLS 1.2 or higher.

6. Cookies & Tracking Technologies

• Consent Management – A banner appears on first visit, describing the strictly necessary cookies.
• Users can open the “Cookie Settings” panel to enable/disable the optional marketing_opt cookie.
• Consent choices are stored in a consent‑receipt log (date, scope, method).

7. Processors & Sub-processors

Future sub‑processors will be added to the Sub‑processor Register (Section 11).

• Due Diligence – Before onboarding, each sub‑processor signs a GDPR‑compliant DPA and provides evidence of adequate security (ISO 27001, SOC 2, etc.).
• DPAs – All DPAs contain clauses on: purpose limitation, data security, breach notification within 72 hours, audit rights, prohibition of onward transfers without our consent.
• Register – The current register is shown below; it is published on our website and updated promptly when new sub‑processors are added.

Sub‑processor Register

8. International Data Transfers

Cross‑Border Transfer Impact Assessment Checklist

1. Identify destination country & legal regime.
2. Verify adequacy or DPF certification.
3. If none, apply SCCs + supplemental safeguards (encryption, limited access).
4. Document residual risk (Low/Medium/High).
5. Obtain DPO sign‑off before transfer.

9. Data Retention

All deletions are performed using industry‑standard cryptographic erasure and verification logs.

10. Security Measures

11. Personal Data Breach Notification

• Detection & Containment – Security team isolates affected systems.
• Internal Escalation – Notify DPO within 4 hours; DPO convenes Incident Response Team.
• Risk Assessment – Determine likelihood of harm, categories of data, number of affected subjects.
• Regulatory Notification – If risk is “high”, notify the Lithuanian Data Protection Authority (VDA) within 72 hours of becoming aware.
• Data‑Subject Notification – If high risk, inform affected users no later than 30 days after breach discovery, using the template below.
• Media Notification – If public interest is high, issue a press release (template provided).
• Post‑Incident Review – Update security controls, document lessons learned, and report to senior management.

Breach‑Notification Templates (excerpt)

Press Release (optional) – follows the same factual structure, adds reassurance about remedial actions.

12. Your Rights

Verification – We will request at least two forms of identification (e.g., government ID + email confirmation) before fulfilling any request.

13. Jurisdiction-Specific Rights

All requests are free of charge, unless they are manifestly unfounded or excessive; in such cases we may charge a reasonable fee.

14. Automated Decision-Making

The Platform does not perform automated decision‑making that produces legal or similarly significant effects. If a future feature introduces such processing, we will:

1. Provide a clear description of the logic involved.
2. Explain the significance and expected consequences.
3. Offer the data subject the right to obtain human intervention, express their point of view, and contest the decision.

15. Legitimate Interest Assessment (LIA)

Current legitimate‑interest processing (aggregated usage analytics) has been assessed and approved (see Appendix A).

16. Data Protection Impact Assessment (DPIA)

When required – Processing that is likely to result in a high risk to the rights and freedoms of data subjects (e.g., large‑scale profiling, processing of special categories).

Procedure

1. Identify the processing activity.
2. Describe the nature, scope, context, and purposes.
3. Assess necessity and proportionality.
4. Evaluate risks to data subjects.
5. Identify measures to mitigate risks.
6. Document the DPIA and obtain DPO approval.

DPIA Register (excerpt)

All DPIAs are stored securely and made available to the supervisory authority upon request.

17. Record of Processing Activities (ROPA)

The full ROPA is published on our corporate intranet for internal audit purposes.

18. Training & Governance

• Frequency – Mandatory privacy & security training annually for all staff; additional onboarding training for new hires.
• Content – GDPR fundamentals, data‑handling procedures, incident‑response, phishing awareness.
• Record‑keeping – Training logs stored for 5 years; each employee’s completion certificate is retained in HR files.

Governance Bodies

• Data Protection Officer (DPO): Monitor compliance, advise on DPIAs, handle DSARs, liaise with authorities.
• Data Governance Committee (senior management): Approve privacy policies, oversee risk assessments, allocate resources.
• Internal Audit Team: Conduct quarterly privacy audits, report findings to the Committee.
• External Auditor: Perform an annual independent audit of GDPR compliance; results published in the Transparency Report.

19. Consent Management

• Obtaining Consent – Clear opt‑in checkbox (unchecked by default) for any processing that relies on consent (e.g., marketing).
• Recording Consent – Consent receipt stored with: user ID, date, scope (e.g., marketing), method (checkbox), and IP address.
• Revoking Consent – Users can withdraw at any time via the “My Settings” page; the system automatically disables the relevant processing and logs the revocation.
• Do Not Sell or Share My Personal Information – Visible link in the website footer; clicking opens a simple form that records the opt‑out and immediately disables any data‑sale/sharing logic.
• Marketing Opt‑Out – Toggle in account settings; disables the marketing_opt cookie and removes the user from all promotional mailing lists.
• Profiling / Targeted Advertising Opt‑Out – Same toggle; ensures no profiling is performed for advertising purposes.

All opt‑outs are respected without delay and logged for audit.

20. Identity Verification

1. Identity proof – Request two of the following: government‑issued ID, recent utility bill, or a signed email from the registered address.
2. Multi‑factor check – Send a one‑time code to the registered e‑mail or phone.
3. Record – Log verification outcome, date, and staff member.
4. Proceed – Only after successful verification do we fulfill the request.

21. Data Classification

All data are labelled in our metadata system; automated controls enforce the handling rules.

22. Data Portability

• Formats – JSON or CSV (UTF‑8).
• Security – Files are encrypted with AES‑256 and delivered via a secure download link that expires after 48 hours.
• Procedure – Upon verified request, the DPO coordinates with the engineering team to extract the data and send the encrypted package.
• Deletion – Cryptographic erasure (overwrite keys) for databases; secure wipe of backup tapes after retention expires.
• Anonymisation for AI Training – If a user later gives explicit consent to use their data for model training, we first pseudonymise (remove identifiers) and then apply statistical anonymisation techniques. No personal data is used for training without that consent.

23. Law Enforcement & Government Requests

1. Receipt – Log the request (date, authority, legal basis).
2. Verification – Confirm the request is valid (court order, subpoena, etc.).
3. Internal Approval – DPO + Legal sign‑off before any disclosure.
4. Disclosure – Provide only the data strictly required; keep a copy of what was disclosed.
5. Record – Maintain a register of all law‑enforcement disclosures for at least 6 years.

We publish an annual Transparency Report (available on our website) that includes:

• Number of government requests received & complied with.
• Number of data breaches disclosed.
• Summary of privacy‑related complaints and resolutions.
• Statistics on DSARs (requests received, fulfilled, average response time).

24. Contact Information & Supervisory Authorities

Complaints may be filed directly with the relevant authority; we will cooperate fully.

25. Non-discrimination

We will not discriminate against any data subject for exercising their privacy rights. This includes: no denial of service, no price increase, and no reduction in the quality of the platform.

26. Disclaimer

This Privacy Policy is provided for informational purposes only and does not constitute legal advice. While we strive to comply with all applicable laws, we limit our liability to the maximum extent permitted by law.

27. Version Control

The policy is reviewed annually or sooner if a material change to processing activities occurs. All revisions are recorded in this table.

Appendix A: LIA Record (Example)

See Section 19 for the full register entry.

Full templates are available in the internal incident‑response repository; excerpts are shown in Section 15.