GDPR Privacy Notice

1. Data Controller

MatricsTek Inc., 8 The Green, Ste R, Dover, DE 19901, USA, acts as the Data Controller when determining the purposes and means of processing your personal data. Where we process data on behalf of enterprise clients, we act as a Data Processor as outlined in our Data Processing Agreement.

For GDPR-related enquiries, contact our data team at contact@matricstek.co.

2. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 GDPR to process your personal data:

• Consent (Art. 6(1)(a)): Where you have given freely given, specific, informed, and unambiguous consent (e.g., marketing communications). You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contract (Art. 6(1)(b)): Where processing is necessary to perform a contract with you (e.g., program enrollment and delivery of services).
• Legitimate Interests (Art. 6(1)(f)): Where processing is in our legitimate business interests (e.g., fraud prevention, service improvement), balanced against your rights.
• Legal Obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law (e.g., tax and accounting obligations).

3. Your GDPR Data Subject Rights

Under the GDPR, you have the following rights. We will respond within one calendar month of a verified request:

• Right to Access (Art. 15): Obtain a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to Restriction (Art. 18): Request that we temporarily pause processing of your data (e.g., while accuracy is contested).
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect lawfulness of prior processing.
• Right to Lodge a Complaint (Art. 77): If you believe we have not handled your data in compliance with GDPR, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or the DPA in your EU member state).

To exercise any rights, email us at contact@matricstek.co.

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Program enrollment data is typically retained for 6 years from the end of the service relationship in line with applicable legal obligations. After this period, data is securely deleted or anonymised.

5. International Data Transfers

Your personal data may be transferred to and processed in the United States, which is outside the EEA. We ensure appropriate safeguards are in place through the use of Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data receives equivalent protection wherever it is processed.