GDPR Compliance Statement

Effective Date: January 20, 2026

Asian Mail Order Brides ("we," "our," or "us") is committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This GDPR Compliance Statement outlines our approach to data protection, explains your rights as a data subject, and demonstrates our commitment to lawful and transparent data processing. We take our obligations under EU privacy regulation seriously and have implemented comprehensive measures to ensure full compliance.

Our Commitment to GDPR Compliance

As an organization that serves users worldwide, including those in the European Economic Area (EEA), we have designed our data processing activities to meet the stringent requirements of the GDPR. Our commitment includes:

• Lawful Processing: We process personal data only when we have a valid legal basis under Article 6 of the GDPR
• Transparency: We provide clear, accessible information about how we collect and use your data
• Data Minimization: We collect only the personal data necessary for specified, legitimate purposes
• Accuracy: We take reasonable steps to ensure personal data remains accurate and up-to-date
• Storage Limitation: We retain personal data only for as long as necessary for the purposes for which it was collected
• Security: We implement appropriate technical and organizational measures to protect personal data
• Accountability: We document our compliance efforts and can demonstrate adherence to GDPR principles

Data Controller Information

For the purposes of the GDPR, the data controller responsible for your personal data is:

As the data controller, we determine the purposes and means of processing your personal data. We are responsible for ensuring that all processing activities comply with GDPR requirements and that your rights as a data subject are protected.

Your Rights Under GDPR

Under the General Data Protection Regulation, you have comprehensive rights regarding your personal data. We respect and uphold all of these rights for our users in the European Economic Area:

Right to Be Informed (Articles 13-14)

You have the right to receive clear, transparent information about how we collect and process your personal data. This includes details about the purposes of processing, legal bases, data retention periods, and your rights.

Right of Access (Article 15)

You can request confirmation of whether we process your personal data and, if so, obtain access to that data along with information about how it is processed. We will provide a copy of your personal data free of charge within one month of receiving your request.

Right to Rectification (Article 16)

If your personal data is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.

Right to Erasure ("Right to Be Forgotten") (Article 17)

You may request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, when you object to processing, or when the data has been unlawfully processed.

Right to Restrict Processing (Article 18)

You can request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you prefer restriction over erasure.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller without hindrance, where processing is based on consent or a contract.

Right to Object (Article 21)

You may object to the processing of your personal data based on legitimate interests, including profiling. You also have the absolute right to object to direct marketing at any time.

Right to Withdraw Consent (Article 7)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing conducted prior to withdrawal.

Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. We do not currently engage in automated decision-making that would fall under this provision.

How We Process Your Personal Data

We process personal data only when we have a valid legal basis under GDPR Article 6. Below are our processing activities and their corresponding legal bases:

When we rely on legitimate interests as a legal basis, we conduct a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may contact us for more information about these assessments.

International Data Transfers

Your personal data may be transferred to, stored, or processed in countries outside the European Economic Area (EEA) where data protection laws may differ from those in the EU. When such transfers occur, we implement appropriate safeguards to ensure your data remains protected in accordance with GDPR requirements:

Transfer Mechanisms

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses with third-party processors located outside the EEA to provide appropriate safeguards for your data
• Adequacy Decisions: Where applicable, we transfer data to countries that the European Commission has recognized as providing adequate data protection
• Supplementary Measures: Following the Schrems II ruling, we implement additional technical and organizational measures where necessary to ensure data protection equivalent to EU standards

Third-Party Service Providers

We engage trusted third-party service providers who may process your data on our behalf. All such processors are contractually bound to process data only on our instructions and to maintain appropriate security measures. Our primary third-party relationships include:

• Web hosting providers (EU and US-based with SCCs)
• Analytics services (configured for IP anonymization)
• Email service providers (GDPR-compliant platforms)

We do not sell your personal data to third parties. Any data sharing is limited to what is necessary for our legitimate business purposes and is conducted in compliance with GDPR transfer requirements.

Data Security Measures

Protecting your personal data is our priority. We implement comprehensive technical and organizational security measures appropriate to the risks associated with data processing. Our security framework includes:

Technical Safeguards

• Encryption: All data transmissions use TLS 1.3 encryption; sensitive data is encrypted at rest
• Access Controls: Role-based access restrictions ensuring data is accessible only on a need-to-know basis
• Network Security: Firewalls, intrusion detection systems, and regular vulnerability assessments
• Secure Development: Security-focused development practices and regular code reviews
• Backup & Recovery: Regular encrypted backups with tested disaster recovery procedures

Organizational Safeguards

• Staff Training: Regular data protection training for all personnel who handle personal data
• Confidentiality Agreements: Binding confidentiality obligations for employees and contractors
• Incident Response: Documented procedures for detecting, reporting, and responding to data breaches
• Vendor Management: Due diligence and contractual safeguards for all third-party processors
• Regular Audits: Periodic security assessments and compliance reviews

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay in accordance with Article 34.

Data Protection Officer Contact

We have designated a Data Protection Officer (DPO) to oversee our GDPR compliance efforts and serve as a point of contact for data protection inquiries. You may contact our DPO for any questions regarding:

• Exercising your data subject rights
• Our data protection practices
• Complaints about how we handle your personal data
• Any other GDPR-related concerns

Supervisory Authority and Complaints

If you are located in the European Economic Area and believe that we have not addressed your data protection concerns adequately, you have the right to lodge a complaint with a supervisory authority. You may contact the supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

We encourage you to contact us first so that we have the opportunity to address your concerns directly. Our goal is to resolve any issues promptly and fairly.

Changes to This Statement

We may update this GDPR Compliance Statement periodically to reflect changes in our data processing practices, legal requirements, or organizational changes. The "Effective Date" at the top of this page indicates when this statement was last revised. We encourage you to review this statement regularly to stay informed about our data protection practices.

Material changes that significantly affect how we process your personal data will be communicated through appropriate channels, such as email notification or a prominent notice on our website.

Related Privacy Documentation

This GDPR Compliance Statement should be read in conjunction with our other privacy-related documents:

• Privacy Policy - Comprehensive details about our data collection and use practices
• Cookie Policy - Information about cookies and tracking technologies
• Terms of Service - Legal terms governing use of our website

By using our website, you acknowledge that you have read and understood this GDPR Compliance Statement. If you have any questions about our data protection practices, please contact our Data Protection Officer at [email protected].