GDPR Compliance Statement

# **GDPR Compliance Statement** **Effective Date:** 09 August 2025 **Company:** HAPPYGLOBAL, LLC **Address:** 1908 Thomes Ave STE 12154, Cheyenne, WY 82001, USA **Contact:** [hello@ftmvai.com](mailto:hello@ftmvai.com) --- ## **1. Introduction** HAPPYGLOBAL, LLC (“Company”, “we”, “our”, “us”) is committed to full compliance with the **General Data Protection Regulation (EU) 2016/679** (“GDPR”) for all users located in the European Economic Area (EEA), the United Kingdom (UK GDPR), and Switzerland. This statement outlines our GDPR compliance measures and your rights as a data subject. --- ## **2. Legal Bases for Processing** We process personal data only when we have a lawful basis under GDPR: * **Contract Performance** (Art. 6(1)(b)) – Providing our virtual try-on services, account management, payment processing. * **Consent** (Art. 6(1)(a) & Art. 9(2)(a) for biometric data) – Marketing communications, AI model training using your data, biometric processing for try-on generation. * **Legitimate Interests** (Art. 6(1)(f)) – Service improvement, fraud prevention, analytics. * **Legal Obligation** (Art. 6(1)(c)) – Compliance with tax, accounting, and legal requirements. --- ## **3. Data Subject Rights** Under GDPR, you have the right to: * **Access** (Art. 15) – Obtain a copy of your personal data. * **Rectification** (Art. 16) – Correct inaccurate or incomplete data. * **Erasure** (Art. 17) – Request deletion (“right to be forgotten”). * **Restriction of Processing** (Art. 18) – Limit processing under certain conditions. * **Data Portability** (Art. 20) – Receive your data in a structured, machine-readable format. * **Object** (Art. 21) – Object to processing based on legitimate interests or direct marketing. * **Withdraw Consent** – At any time, without affecting prior lawful processing. * **Rights Related to Automated Decision-Making** (Art. 22) – Not to be subject solely to automated decisions that significantly affect you. **How to exercise:** Email [hello@ftmvai.com](mailto:hello@ftmvai.com) with your request. We respond within **30 days**. --- ## **4. Biometric Data Processing** If you upload images containing biometric identifiers (facial geometry, measurements, etc.): * We process them **only with your explicit consent** under GDPR Art. 9(2)(a). * They are used for try-on generation and, if consented, AI model improvement. * Retained for a maximum of **3 years** from last activity or until deletion request. --- ## **5. International Data Transfers** * Data may be transferred outside the EEA, UK, and Switzerland (e.g., to the USA). * We use **Standard Contractual Clauses (SCCs)** and Transfer Impact Assessments to ensure equivalent protection. * Our main processors include OpenAI, Anthropic, Google Cloud, AWS, Stripe, PayPal, and Twilio. --- ## **6. Data Security Measures** * **Encryption:** AES-256 at rest, TLS 1.3 in transit. * **Access Controls:** MFA, role-based access, least-privilege principle. * **Monitoring:** Continuous security audits and penetration testing. * **Incident Response:** Data breach notifications within 72 hours to supervisory authorities and affected users where required. --- ## **7. Data Protection Officer (DPO)** **Name:** Data Protection Officer – HAPPYGLOBAL, LLC **Email:** [hello@ftmvai.com](mailto:hello@ftmvai.com) (Subject: “DPO – Privacy Inquiry”) **Mail:** 1908 Thomes Ave STE 12154, Cheyenne, WY 82001, USA --- ## **8. Supervisory Authority Contact** If you are in the EU, you have the right to lodge a complaint with your national data protection authority. A list is available at: [https://edpb.europa.eu/about-edpb/board/members\_en](https://edpb.europa.eu/about-edpb/board/members_en) --- ## **9. Updates** We may update this GDPR Compliance Statement to reflect changes in regulations or our practices. We will notify users of material changes at least **30 days** before they take effect.