GDPR Policy

This GDPR Compliance Policy outlines DreamFox's adherence to the EU General Data Protection Regulation (GDPR) regarding the collection, processing, storage, and transfer of personal data belonging to EU residents.

1. Legal Basis for Processing

DreamFox processes personal data lawfully under the following bases:

• Consent
• Contractual necessity
• Legitimate business interest
• Compliance with legal obligations

2. Rights of Data Subjects

EU users have the right to:

• Access their data
• Correct inaccurate data
• Request deletion ("Right to be Forgotten")
• Restrict processing
• Object to data usage
• Port data elsewhere
• Withdraw consent at any time
• Lodge complaints with EU Data Protection Authorities

Requests must be fulfilled within 30 days.

3. Data Collected

We collect:

• Identity data (name, company, title)
• Contact data (email, phone)
• Behavioral analytics (via cookies)
• AI-measured insights
• Voluntary form submissions

Sensitive data is not collected without explicit consent.

4. Data Transfers

Data may be processed in:

• The United States
• India
• Partner locations

All transfers comply with Standard Contractual Clauses (SCCs) or equivalent safeguards.

5. Security Commitments

DreamFox employs:

• Encryption
• MFA
• Continuous monitoring
• Data access policies
• Cybersecurity audits
• Breach response mechanisms

6. Data Retention

Data is retained only as necessary for business, regulatory, or contractual obligations.

7. Marketing Communications

GDPR-compliant email marketing includes:

• Explicit opt-ins
• Clear unsubscribe options
• Transparent data usage disclosure
• No unauthorized sharing or selling