GDPR Compliance | Best Ad Tracker

1. Introduction

Best Ad Tracker is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This document outlines how we comply with GDPR requirements and how we support our customers in their GDPR compliance efforts.

2. Our Role Under GDPR

2.1 As a Data Controller

We act as a Data Controller for the personal data of our customers (account holders). This includes:

Account registration information (email, name)
Billing and payment information
Communication records
Usage data related to our Service

2.2 As a Data Processor

We act as a Data Processor when handling tracking data on behalf of our customers. In this role, we process data according to our customers' instructions and implement appropriate technical and organizational measures to protect such data.

3. Legal Basis for Processing

We process personal data based on the following legal grounds:

Contract Performance: Processing necessary to provide our Service
Legitimate Interests: For security, fraud prevention, and service improvement
Legal Obligation: When required by law
Consent: For marketing communications (with opt-out available)

4. Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

4.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and access to that data, including:

Categories of personal data processed
Purposes of processing
Recipients of your data
Retention periods

4.2 Right to Rectification (Article 16)

You can request correction of inaccurate personal data or completion of incomplete data. You can update most information directly in your account settings.

4.3 Right to Erasure (Article 17)

Also known as the "right to be forgotten," you can request deletion of your personal data when:

Data is no longer necessary for its original purpose
You withdraw consent (where consent was the legal basis)
You object to processing and there are no overriding legitimate grounds
Data was unlawfully processed

4.4 Right to Restriction (Article 18)

You can request restriction of processing in certain circumstances, such as when you contest the accuracy of data or object to processing.

4.5 Right to Data Portability (Article 20)

You can request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

4.6 Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes.

4.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that significantly affect you. Our fraud detection systems may flag suspicious activity, but significant decisions are reviewed by humans.

5. Exercising Your Rights

To exercise any of your GDPR rights, you can:

Email us at [email protected]
Use the data export feature in your account settings
Submit a request through our support portal

We will respond to your request within 30 days. If the request is complex, we may extend this by an additional 60 days with notification.

6. Data Protection Measures

We implement comprehensive technical and organizational measures including:

Technical Measures

Encryption of data in transit (TLS 1.3)
Encryption of sensitive data at rest (AES-256)
Regular security assessments and penetration testing
Access controls with role-based permissions
Multi-factor authentication available
Automated vulnerability scanning
Secure development practices

Organizational Measures

Staff training on data protection
Data protection policies and procedures
Incident response plan
Vendor due diligence
Regular policy reviews

7. International Data Transfers

When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Supplementary measures as needed per Schrems II requirements

8. Data Processing Agreement

We offer a Data Processing Agreement (DPA) to customers who require one for GDPR compliance. Our DPA includes:

Subject matter and duration of processing
Nature and purpose of processing
Types of personal data processed
Categories of data subjects
Obligations and rights of the controller
Technical and organizational measures
Sub-processor provisions

9. Sub-Processors

We use carefully vetted sub-processors to help deliver our Service. Key sub-processors include:

Infrastructure Providers: For hosting and data storage
Payment Processors: For billing and payments
Analytics Providers: For service improvement

All sub-processors are bound by data processing agreements and subject to security assessments.

10. Data Breach Notification

In the event of a personal data breach:

We will notify affected customers within 72 hours of becoming aware
We will provide details about the breach, its impact, and remediation steps
We will cooperate with supervisory authorities as required
We will document the breach and our response

11. Your Responsibilities as a Customer

When using our Service to track end users, you are responsible for:

Obtaining appropriate consent or legal basis for tracking
Providing privacy notices to your end users
Responding to data subject requests from your end users
Ensuring your use complies with applicable laws
Configuring appropriate data retention settings

12. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. You can find your local supervisory authority on the European Data Protection Board website.

13. Contact Our Data Protection Team

For any GDPR-related inquiries or to exercise your rights:

Email: [email protected]
Response time: Within 30 days
Website: batracker.cloud