Back to Home

GDPR Compliance Statement

Last Updated: March 17, 2026

1. Introduction

This GDPR Compliance Statement explains how Thravic complies with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) when processing personal data.

Thravic is committed to protecting the privacy and rights of individuals within the European Economic Area (EEA) and ensuring lawful, fair, and transparent data processing practices.

2. Roles and Responsibilities

Under GDPR:

  • Thravic acts as a Data Processor
  • Our Customers act as Data Controllers

We process personal data only on behalf of and under the instructions of our Customers.

For our customers’ own account details (name, email, date of birth, country and phone), Thravic is the controller; the Privacy Policy (section 3.5) says what we keep and why.

Customers are responsible for:

  • Determining the legal basis for processing
  • Obtaining user consent where required
  • Providing appropriate privacy notices to end-users

3. Lawful Basis for Processing

Thravic processes personal data only where a lawful basis exists, including:

  • Legitimate Interests – for analytics, performance monitoring, and service improvement
  • Consent – where required (e.g., cookie consent banners implemented by Customers)
  • Legal Obligations – where processing is necessary to comply with applicable laws

4. Data Protection Principles

Thravic adheres to the core GDPR principles:

4.1 Lawfulness, Fairness, and Transparency

We ensure all processing is lawful and transparent.

4.2 Purpose Limitation

Data is collected only for specific, explicit, and legitimate purposes (analytics and performance insights).

4.3 Data Minimization

We collect only the minimum amount of data necessary to provide our services.

4.4 Accuracy

We take reasonable steps to ensure data is accurate and up to date.

4.5 Storage Limitation

Data is retained only for as long as necessary and may be anonymized for long-term analytics.

4.6 Integrity and Confidentiality

We protect data using strong security measures including encryption and access controls.

5. Data Subject Rights

Under GDPR, individuals have the following rights:

  • Right of Access – to know what data is collected
  • Right to Rectification – to correct inaccurate data
  • Right to Erasure (“Right to be Forgotten”)
  • Right to Restrict Processing
  • Right to Data Portability
  • Right to Object to Processing
  • Rights related to Automated Decision-Making

Important Note: Because Thravic acts as a Data Processor, requests should be directed to the relevant Customer (Data Controller). We assist Customers in fulfilling these rights where required.

6. Data Security Measures

Thravic implements appropriate technical and organizational safeguards:

  • Encryption (TLS/HTTPS) for data in transit
  • Encrypted storage for data at rest
  • Strict role-based access controls
  • Monitoring and threat detection systems

7. Data Breach Notification

In the event of a personal data breach:

  • Thravic will notify affected Customers without undue delay
  • Customers are responsible for notifying supervisory authorities and affected users where required

8. Sub-Processors

Thravic may use trusted third-party service providers (sub-processors) such as:

  • Cloud hosting providers
  • Infrastructure and security services

We ensure that all sub-processors:

  • Are GDPR-compliant
  • Are bound by Data Processing Agreements
  • Provide adequate safeguards for data protection

9. International Data Transfers

Where personal data is transferred outside the EEA, Thravic ensures appropriate safeguards, including:

  • Standard Contractual Clauses (SCCs)
  • Transfers to jurisdictions with adequate protection levels

10. Privacy by Design and Default

Thravic is built with privacy-first architecture, including:

  • Minimal data collection
  • IP anonymization practices
  • No cross-site tracking
  • No selling or monetization of personal data

Default settings are configured to ensure maximum privacy protection.

11. Data Retention

Data retention depends on Customer configuration and plan level:

  • Short-term identifiable data is minimized
  • Long-term analytics data is anonymized or aggregated

12. Cookies and Tracking Technologies

Thravic may use cookies or similar technologies to:

  • Track sessions
  • Measure user interactions
  • Improve analytics accuracy

Customers are responsible for:

  • Implementing cookie consent banners
  • Obtaining user consent where required under GDPR and ePrivacy Directive

13. Data Protection Officer (DPO)

At this stage, Thravic may not require a formal Data Protection Officer under GDPR Article 37.

However, privacy-related inquiries can be directed to:

Email: thravic247@gmail.com

14. Supervisory Authority

EU users have the right to lodge complaints with their local data protection authority if they believe their rights have been violated.

15. Updates to This Statement

We may update this GDPR Compliance Statement periodically. Changes will be reflected by the “Last Updated” date.

16. Commitment to Compliance

Thravic is committed to maintaining full GDPR compliance by:

  • Continuously improving data protection practices
  • Monitoring regulatory developments
  • Ensuring transparency and accountability

Final Note

Thravic is designed to give businesses powerful analytics capabilities without compromising user privacy, aligning with modern regulatory standards and ethical data practices.