Effective date: 2026-10-27.
The EU General Data Protection Regulation (2016/679) ("GDPR"), the UK Data Protection Act 2018 and UK GDPR, and the Swiss Federal Act on Data Protection ("FADP") are laws that apply to how we handle personal data. This Statement describes our approach to those obligations and how you can exercise your rights.
1. Our roles
We act in two different capacities depending on the data:
- Controller, for personal data we collect for our own purposes: our website visitors, sales prospects, billing contacts, and vendor contacts. The lawful bases and purposes are described in our Privacy Policy.
- Processor, for personal data that a Customer submits to or generates within the Services on behalf of its end users, employees, and contacts. Our obligations as processor are set out in our Data Processing Addendum.
2. Lawful bases (when we act as controller)
| Processing | Lawful basis |
|---|---|
| Creating & servicing your account | Performance of a contract (Art. 6(1)(b)) |
| Processing payment & tax | Performance of a contract; legal obligation |
| Security monitoring & abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| B2B marketing to existing customers | Legitimate interests (with opt-out) |
| Marketing to prospects | Consent where required; legitimate interests where permitted |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Aggregate analytics & product improvement | Legitimate interests |
3. Your rights
Under the GDPR you have the right to:
- Information (Art. 13 & 14), be informed about what we do with your personal data;
- Access (Art. 15), obtain a copy of your personal data and information about its processing;
- Rectification (Art. 16), have inaccurate or incomplete data corrected;
- Erasure (Art. 17), request deletion of your personal data;
- Restriction (Art. 18), restrict our processing in certain circumstances;
- Portability (Art. 20), receive your personal data in a structured, commonly used, machine-readable format;
- Object (Art. 21), object to processing based on legitimate interests, including direct marketing;
- Not be subject to automated decision-making (Art. 22), including profiling that produces legal or similarly significant effects.
To exercise these rights, contact contact@wrxstack.com. We may need to verify your identity before we act on a request. We respond within the period the GDPR requires, which is one month from receipt, extendable by two further months where the law permits; if we extend, we will tell you, as the law requires. These rights are subject to the conditions and exceptions the GDPR sets. Where wrxstack acts as a processor, we may refer your request to the relevant Customer (the controller), and we assist the Customer to the extent the DPA or the law requires.
4. Automated decision-making & profiling
We do not use Customer Content to make decisions with legal or similarly significant effects about data subjects.
5. International data transfers
wrxstack is operated from India, and its infrastructure is hosted in the United States. For transfers from the EEA, UK, or Switzerland to India, the United States, or other non-adequate countries, where a transfer mechanism is required, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss FDPIC addendum. There is more detail in our DPA Annex II.
6. Data retention principles
We retain personal data only for as long as needed for the purpose for which it was collected, to comply with law, and to resolve disputes. When a subscription ends, we take reasonable steps to delete Customer Content from the live database within a reasonable period, and copies in our hosting provider's backups age out on that provider's ordinary rotation. The Data Retention Policy has more detail. We may retain limited records (for example, billing and tax) for the period required by law.
7. Security and certifications
We take reasonable steps to protect personal data. Our measures include encryption in transit (TLS 1.3) and encryption at rest inherited from our managed hosting provider. We do not use Customer Content to train models, and the model providers' API terms, as we understand them, do not permit them to train on it. No method of transmission or storage is completely secure, and we cannot guarantee the security of any data. We want to be plain about this: wrxstack holds no security or compliance certifications. We have no SOC 2 report, no ISO 27001 certificate, and we have not undergone a third-party audit or penetration test. See DPA Annex II.
8. Complaints
If you believe our processing of your personal data violates the GDPR, you are welcome to contact us first so we can try to address your concern. You also have the right to lodge a complaint with a supervisory authority, in particular the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. A list of EU supervisory authorities is published by the European Data Protection Board. UK residents may complain to the UK ICO; Swiss residents to the Federal Data Protection and Information Commissioner.
9. Legal effect of this Statement
This Statement explains our practices. It is not a contract, and it does not create any contractual obligation, warranty, guarantee, or right for you or for any other person. The only agreements between you and wrxstack are the Terms of Service and, where it applies, the Data Processing Addendum.
Timelines and targets in this Statement are goals we aim to meet, not guarantees, except where a law that applies to us sets a deadline, in which case we follow that law. Nothing in this Statement increases wrxstack's liability. The disclaimers, the limitation of liability, and the other protections in the Terms of Service apply to everything this Statement describes. Nothing in this Statement limits a right you have under a law that cannot be limited by agreement.
10. Contact
For any GDPR-related question, contact contact@wrxstack.com.