GDPR Compliance

GEO BUBBLES is committed to protecting personal data in full compliance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679) and the Swiss Federal Act on Data Protection (FADP / nDSG). This page outlines how we meet our obligations and how you can exercise your rights as a data subject.

1. Data Controller

GEO BUBBLES

Email: privacy@geobubbles.com

2. Legal Bases for Processing

We process personal data only when we have a valid legal basis under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Service you have subscribed to, including account management, data analytics, and AI chat functionality.
• Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for analytics cookies, marketing communications, or connecting third-party accounts.
• Legitimate interests (Art. 6(1)(f)): For improving our Service, ensuring security, preventing fraud, and conducting internal analytics — where these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)): Where we are required to process data by applicable laws.

3. Your Rights Under GDPR

As a data subject, you have the following rights. To exercise any of these rights, contact us at privacy@geobubbles.com. We will respond within 30 days.

3.1 Right of Access (Art. 15)

You have the right to request confirmation of whether we process your personal data and to obtain a copy.

3.2 Right to Rectification (Art. 16)

You have the right to request correction of inaccurate personal data. You can update most information in your account settings.

3.3 Right to Erasure (Art. 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent and there is no other legal basis
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

We may retain certain data where required by law.

3.4 Right to Restriction of Processing (Art. 18)

You can request restriction of processing in certain circumstances, such as when you contest the accuracy of the data.

3.5 Right to Data Portability (Art. 20)

You have the right to receive your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).

3.6 Right to Object (Art. 21)

You have the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.

3.7 Right Not to Be Subject to Automated Decision-Making (Art. 22)

Our AI-powered analytics are informational tools. We do not make automated decisions with legal or similarly significant effects without human involvement.

4. Data Protection Impact Assessments

Where processing is likely to result in high risk, we conduct DPIAs in accordance with Article 35 GDPR, including for AI processing and large-scale data analytics.

5. International Data Transfers

Our primary data storage is in the EU/EEA/Switzerland. Where data is transferred outside, we ensure adequate safeguards:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions where applicable
• Data processing agreements with all sub-processors

For details on our sub-processors, see our Data Handling Policies.

6. Data Protection by Design and Default

In accordance with Article 25 GDPR:

• Data minimization — we collect only what is necessary
• Purpose limitation — data is processed only for specified purposes
• Access controls — row-level security ensures users only see their own data
• Encryption — all data encrypted at rest and in transit
• Privacy-friendly defaults — analytics cookies disabled by default

7. Consent Management

Where we rely on consent:

• Consent is freely given, specific, informed, and unambiguous
• You can withdraw consent at any time
• Cookie consent managed through our cookie consent banner
• Third-party integrations require explicit authorization

8. Children's Data

Our Service is not directed at children under 16. We do not knowingly collect personal data from children.

9. Supervisory Authority

If you believe your data protection rights have been violated, you may lodge a complaint with:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern, Switzerland
www.edoeb.admin.ch

For EU residents, you may contact the supervisory authority in your country of residence. edpb.europa.eu

10. Updates to This Policy

We review and update this page as our practices evolve or as regulatory requirements change. Material changes will be communicated via email or platform notice.

11. Contact Us

For any GDPR-related inquiries or to exercise your rights, contact us at:
GEO BUBBLES

Email: privacy@geobubbles.com