Data Protection

SMGTY Europe OÜ

SMGTY is the data controller under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

Data protection contact: [email protected]

We implement the following technical controls to protect your data:

• Supplier assessment: third-party processors are evaluated for GDPR compliance before onboarding
• Data processing agreements: DPAs signed with all processors per GDPR Art. 28
• Incident response: documented procedure for detecting, containing, and reporting breaches within 72 hours (GDPR Art. 33)
• Records of processing: maintained per GDPR Art. 30

When personal data is transferred outside the European Economic Area (EEA):

• We rely on European Commission adequacy decisions where available
• Otherwise we use Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfer impact assessments are conducted for high-risk transfers

In the event of a personal data breach:

• Supervisory authority: We notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of the breach (GDPR Art. 33)
• Affected individuals: We notify without undue delay when the breach is likely to result in a high risk (GDPR Art. 34)
• Notifications include the nature of the breach, categories and approximate number of affected records, likely consequences, and measures taken

Submit data subject requests to [email protected] or via our contact form.

We may require identity verification before fulfilling requests. If we cannot comply, we will explain why.