CCPA & GDPR Compliance

1. Introduction

At Digital Judas, we are committed to protecting your privacy and ensuring compliance with applicable data protection laws, including the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). This page explains how we comply with these regulations and outlines your rights regarding your personal data.

This compliance notice supplements our Privacy Policy and provides specific information about your rights under GDPR and CCPA. We encourage you to read both documents to fully understand how we handle your personal information.

2. GDPR Overview

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to the processing of personal data of individuals located in the European Economic Area (EEA), regardless of where the processing entity is located. The GDPR aims to give individuals control over their personal data and to simplify the regulatory environment for international business.

Under the GDPR, we act as both a data controller and a data processor:

• As a data controller, we determine the purposes and means of processing personal data collected from our users, tool submitters, and newsletter subscribers.
• As a data processor, we process personal data on behalf of our tool submitters who use our platform to list their tools.

3. CCPA Overview

The California Consumer Privacy Act (CCPA) provides California residents with specific rights regarding their personal information. The CCPA grants California consumers the right to know what personal information is collected about them, the right to delete personal information, the right to opt-out of the sale of personal information, and the right to non-discrimination for exercising these rights.

While Digital Judas may not meet all thresholds that would legally require CCPA compliance, we voluntarily extend CCPA protections to all California residents as part of our commitment to privacy and transparency.

4. Your Data Rights

Depending on your location and applicable law, you may have some or all of the following rights regarding your personal data:

GDPR Rights (EU/EEA Residents)

• Right to access - You have the right to request copies of your personal data.
• Right to rectification - You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to erasure - You have the right to request that we erase your personal data, under certain conditions.
• Right to restrict processing - You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to object to processing - You have the right to object to our processing of your personal data, under certain conditions.
• Right to data portability - You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
• Right to withdraw consent - You have the right to withdraw your consent at any time where we relied on your consent to process your personal data.

CCPA Rights (California Residents)

• Right to know - You have the right to request that we disclose what personal information we collect, use, disclose, and sell.
• Right to delete - You have the right to request the deletion of your personal information that we collect or maintain, subject to certain exceptions.
• Right to opt-out of sale - You have the right to opt-out of the sale of your personal information. Note that Digital Judas does not sell personal information in the traditional sense, but sharing data with our affiliate partners may be considered a "sale" under the CCPA's broad definition.
• Right to non-discrimination - You have the right not to be discriminated against for exercising your CCPA rights.

5. How to Exercise Your Rights

You can exercise your data rights by contacting us using the information provided in the Contact Information section below. To help protect your privacy and maintain security, we may take steps to verify your identity before granting access to your information or complying with your request.

We will respond to your request within 30 days (or as required by applicable law). If we need more time, we will inform you of the reason and extension period in writing.

6. Data Protection Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data during transmission and at rest
• Regular testing and evaluation of the effectiveness of security measures
• Ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services
• Process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures
• Procedures to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider:

• The amount, nature, and sensitivity of the personal data
• The potential risk of harm from unauthorized use or disclosure
• The purposes for which we process the data and whether we can achieve those purposes through other means
• Applicable legal requirements

7. International Data Transfers

Digital Judas is based in the United States, and we may transfer personal data from the EEA, UK, Switzerland, or other regions with data protection laws to jurisdictions that may not provide equivalent levels of data protection.

When we transfer personal data from the EEA, UK, or Switzerland to the United States or other countries which have not been deemed to provide an adequate level of data protection, we use one or more of the following legal mechanisms:

• Standard Contractual Clauses approved by the European Commission
• Explicit consent from the data subject for the transfer
• Necessity for the performance of a contract between the data subject and Digital Judas

By using our services, you acknowledge that your personal data may be transferred to our servers in the United States and to third parties with whom we share it as described in our Privacy Policy.

8. Data Protection Officer

While not legally required to do so, Digital Judas has voluntarily appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with data protection laws. Our DPO serves as a point of contact for data subjects and supervisory authorities on all issues related to the processing of personal data.

The DPO's responsibilities include:

• Informing and advising Digital Judas and its employees about their obligations under data protection laws
• Monitoring compliance with applicable data protection laws
• Providing advice regarding data protection impact assessments
• Cooperating with supervisory authorities
• Acting as a point of contact for data subjects on privacy matters

You can contact our DPO at dpo@digitaljudas.com.

9. Contact Information

If you have any questions, concerns, or requests regarding this CCPA & GDPR Compliance notice or how we handle your personal data, please contact us at:

For EU/EEA residents: You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement if you consider that our processing of your personal data infringes the GDPR.

For California residents: If you are a California resident and have questions about our CCPA compliance, you can also reach us using the contact information above.