GDPR Policy

1. Introduction and Scope

This GDPR Policy supplements our Privacy Policy and provides additional information required by the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK GDPR") for users located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland (collectively, "European Users").

K. Agency LLC, located at 16192 Coastal Highway, Lewes, Delaware 19958, United States, is the data controller responsible for the processing of your personal data when you use the fullCV.online Service.

2. Legal Bases for Processing

Under the GDPR, we process your personal data based on the following legal bases:

3. Your Rights Under GDPR

As a European User, you have the following rights under the GDPR:

• Right of Access (Art. 15): You have the right to request confirmation of whether we process your personal data and to obtain a copy of such data
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate personal data or completion of incomplete personal data. You can update most of your data directly through the Service
• Right to Erasure (Art. 17): You have the right to request deletion of your personal data ("right to be forgotten") when it is no longer necessary for the purpose for which it was collected, when you withdraw consent, or when processing is unlawful. Certain data may be retained where required by law
• Right to Restriction of Processing (Art. 18): You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of your data or when processing is unlawful but you oppose erasure
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON) and to request transmission to another controller where technically feasible
• Right to Object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests. Where we process data for direct marketing purposes, you have an absolute right to object
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal
• Right Not to Be Subject to Automated Decision-Making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. Our AI features provide suggestions that require your review and approval and do not constitute automated decision-making

4. How to Exercise Your Rights

You may exercise any of the above rights by contacting us at support@fullCV.online. Please include sufficient information to identify yourself and specify the right you wish to exercise. We may request additional verification of your identity before processing your request.

We will respond to your request without undue delay and in any event within one (1) month of receipt. This period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension and the reasons for the delay.

There is no charge for exercising your rights. However, if requests are manifestly unfounded or excessive (particularly if repetitive), we may charge a reasonable fee or refuse to act on the request.

5. International Data Transfers

As K. Agency LLC is established in the United States, your personal data will be transferred to and processed in the United States. We ensure that such transfers comply with GDPR requirements through the following safeguards:

• Standard Contractual Clauses (SCCs): We enter into EU-approved Standard Contractual Clauses with service providers and sub-processors located outside the EEA/UK to ensure an adequate level of data protection
• Supplementary Measures: Where appropriate, we implement additional technical and organizational measures to supplement the SCCs, including encryption, access controls, and data minimization
• Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission for data transfers to countries deemed to provide an adequate level of data protection

6. Data Protection Officer

Given the nature and scale of our data processing activities, we have not appointed a formal Data Protection Officer. For all data protection inquiries and requests, please contact us at:

7. Sub-Processors

We use the following categories of sub-processors to provide the Service:

• Cloud Hosting and Infrastructure: For storing and serving application data and user content
• Payment Processing: Stripe, Inc. (United States) — for processing payments and managing subscriptions
• AI Model Providers: For processing AI-assisted content generation requests
• Email Delivery: For sending transactional and account-related emails
• Analytics: For understanding Service usage and performance
• Advertising: Google LLC (United States) — for displaying advertisements via Google AdSense. Google may collect and process data including cookies and device identifiers to serve personalized ads. See How Google uses data when you use our partners' sites or apps

All sub-processors are bound by data processing agreements that comply with GDPR requirements. You may request a detailed list of current sub-processors by contacting us at support@fullCV.online.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

9. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) where required by Article 35 of the GDPR, particularly when introducing new technologies or processing activities that are likely to result in a high risk to the rights and freedoms of data subjects.

10. Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement. A list of supervisory authorities is available at: https://edpb.europa.eu

We encourage you to contact us first at support@fullCV.online so that we can try to resolve your concern directly.

11. Changes to This GDPR Policy

We may update this GDPR Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and, where appropriate, by sending you a notification. Your continued use of the Service after the changes take effect constitutes your acknowledgment of the updated policy.