GDPR Compliance Statement

Effective Date: August 23, 2025 Last Updated: August 23, 2025

This GDPR Compliance Statement sets out how UnitedIP.org (“we,” “our,” or “us”) complies with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) when processing the personal data of individuals located in the European Union (EU) and European Economic Area (EEA).

We recognize our role as a Data Controller under GDPR and have implemented appropriate policies, technical safeguards, and contractual commitments to protect your personal data.

---

1. Scope of Application

This Statement applies to:

• All EU/EEA residents using UnitedIP.org Services.
• Processing activities relating to: account creation, payments, analytics, cookies, and consultancy.
• Cross-border transfers of personal data outside the EU/EEA.

---

2. Legal Basis for Processing (Article 6 GDPR)

We process personal data only where a valid lawful basis applies:

• Contractual necessity (Art. 6(1)(b)) – providing our SaaS platform and consultancy.
• Consent (Art. 6(1)(a)) – marketing communications and cookies.
• Legitimate interests (Art. 6(1)(f)) – service improvements, fraud prevention, and security.
• Legal obligations (Art. 6(1)(c)) – tax, compliance, and regulatory reporting.

---

3. GDPR Data Subject Rights

Under GDPR, you have the following rights:

• Right of Access (Art. 15) – obtain confirmation and a copy of your data.
• Right to Rectification (Art. 16) – correct inaccuracies.
• Right to Erasure (Art. 17) – request deletion (“right to be forgotten”).
• Right to Restrict Processing (Art. 18) – limit processing under certain conditions.
• Right to Data Portability (Art. 20) – receive your data in a structured, machine-readable format.
• Right to Object (Art. 21) – object to processing, including for marketing.
• Right to Withdraw Consent (Art. 7) – withdraw consent at any time.
• Right to Lodge a Complaint (Art. 77) – with your local EU supervisory authority.

---

4. Exercising Your Rights

You may exercise your rights by contacting us:

• 📧 Email: [email protected]
• 📞 Phone: +63 910 1449-777
• 📮 Address: 799-B, J.M. Basa St., City Proper, Iloilo, 5000, Philippines

We will respond within 30 days in accordance with GDPR timelines.

---

5. International Data Transfers (Articles 44–49 GDPR)

As a Philippine-based company, we transfer data outside the EU/EEA. Safeguards include:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Encryption & pseudonymization of transferred data.
• Confidentiality agreements with third-party processors.

---

6. Data Security (Article 32 GDPR)

We implement appropriate technical and organizational measures:

• TLS encryption for all transmissions.
• AES-256 encryption for stored data.
• Cloudflare DDoS protection and firewalls.
• Role-based access controls and monitoring.

---

7. Data Retention (Article 5(1)(e) GDPR)

• Account/payment records: retained 7 years (legal obligation).
• Analytics & cookies: retained 26 months.
• Marketing data: retained until consent is withdrawn.

After retention periods, data is securely deleted or anonymized.

---

8. Third-Party Processors

We only use processors that provide GDPR-level protection, including:

• Stripe & PayPal – payment processing.
• Google Analytics – analytics.
• Cloudflare – security and CDN.

Each third party is bound by Data Processing Agreements (DPAs).

---

9. Data Protection Officer (DPO)

UnitedIP.org DPO Contact:

• 📧 Email: [email protected]
• 📮 Address: 799-B, J.M. Basa St., City Proper, Iloilo, 5000, Philippines

---

⚖️ This GDPR Statement demonstrates full compliance with GDPR and reinforces user trust in our handling of personal data.

Version: 1.0.0