GDPR Compliance

Effective Date: January 1, 2026 · Last Updated: January 21, 2026

1. Our Commitment

BasePOWR is committed to protecting the personal data of all users, including those in the European Union and European Economic Area. We comply with the General Data Protection Regulation (GDPR) and have implemented appropriate technical and organizational measures to ensure the security and privacy of personal data.

2. Data We Collect

We collect the following categories of personal data:

Account Data: Name, email address, phone number, organization affiliation.
Contact Data: Information about contacts added to the CRM by users.
Usage Data: Page views, feature interactions, and session analytics (anonymized where possible).
Payment Data: Billing information processed by Stripe (we do not store card numbers).
Communication Data: Messages sent through the platform, email content, and chat logs.

3. Legal Basis for Processing

We process personal data based on the following legal grounds:

Contract Performance: Processing necessary to provide the service you signed up for.
Legitimate Interest: Processing for analytics, security, and product improvement.
Consent: Where you have given explicit consent (e.g., marketing communications).
Legal Obligation: Where required by law (e.g., tax records, regulatory compliance).

4. Your Rights

Under the GDPR, you have the following rights:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate personal data.
Right to Erasure: Request deletion of your personal data (“right to be forgotten”).
Right to Restrict Processing: Request limitation of how we process your data.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

5. Data Security

We implement industry-standard security measures including encryption in transit (TLS 1.3) and at rest, role-based access controls, multi-factor authentication, regular security audits, and automated vulnerability scanning. Our infrastructure runs on enterprise-grade cloud providers with SOC 2 compliance.

6. Data Transfers

Your data is processed in Canada and the United States. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission and/or adequacy decisions where applicable.

7. Data Retention

We retain personal data only for as long as necessary to provide the service and comply with legal obligations. Analytics event data is automatically purged after 90 days. You may request deletion of your data at any time by contacting our Data Protection Officer.

8. Data Protection Officer

For any GDPR-related inquiries, data access requests, or to exercise your rights, contact our Data Protection Officer at [email protected]. We will respond to all requests within 30 days.

9. Supervisory Authority

If you believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU/EEA supervisory authorities can be found at edpb.europa.eu.