GDPR Compliance
Last Updated: October 12, 2026
Patriy is designed to meet the requirements of the EU General Data Protection Regulation (GDPR). Your data rights are protected.
What is GDPR?
The General Data Protection Regulation (GDPR) is a comprehensive data protection law in the European Union that sets rules for how personal data must be processed and protected. Patriy complies with GDPR regardless of where you're located.
Your Rights Under GDPR
Right to Access
You have the right to obtain a copy of your personal data and information about how we process it. Submit a request at any time.
Right to Rectification
If your data is inaccurate or incomplete, you can request correction. We'll update your records within 30 days.
Right to Erasure
Also known as "Right to be Forgotten." You can request deletion of your personal data, subject to legal obligations.
Right to Restrict
You can restrict how we use your data while we investigate disputes or verify accuracy.
Right to Portability
Get your data in a structured, commonly-used format (CSV, JSON) and transfer it to another service.
Right to Object
Object to processing of your data for marketing, profiling, or other specific purposes.
Automated Decision-Making
Right to human review of automated decisions that affect you. We implement safeguards for AI processing.
Right to Withdraw Consent
If we process data based on your consent, you can withdraw it at any time without affecting past processing.
How to Exercise Your Rights
Step 1: Submit a Request
Contact YM PROPERTYPATH - SMC LTD at hello@patriy.com with your name, email, and the specific right you're exercising.
Example: "I request access to all personal data Patriy holds about me."
Step 2: Verify Identity
We'll verify your identity to ensure we're sharing data with the right person. This may involve additional verification.
Step 3: Response
We'll respond within 30 days of verification (or 90 days for complex requests).
Step 4: No Cost
There is no charge for exercising your rights (unless requests are manifestly unfounded).
Legal Basis for Data Processing
Under GDPR, we only process data under legitimate legal bases:
📋 Contract Performance
Processing necessary to provide the Service (conversations, account management, payments).
✅ Consent
Marketing communications and optional analytics. You can withdraw consent anytime.
⚖️ Legal Obligation
Compliance with tax, accounting, and regulatory requirements.
🛡️ Legitimate Interest
Security, fraud prevention, and service improvement where your rights aren't overridden.
International Data Transfers
Patriy complies with GDPR rules on international data transfers:
- ✓ Standard Contractual Clauses (SCCs): Used for transfers outside EU/EEA
- ✓ Data Residency Options: Customers can choose EU-only servers
- ✓ Data Processing Agreements (DPA): Enterprise customers receive signed DPAs
Contact us for EU-only data residency: hello@patriy.com
Data Retention Schedule
| Data Type | Retention Period |
|---|---|
| Account Information | During subscription + 30 days after cancellation |
| Conversations | Per subscription plan; deleted upon account deletion |
| Billing Records | 7 years (tax requirement) |
| Login Audit Logs | 12 months |
| Support Tickets | 3 years |
| Marketing Cookies | Until consent withdrawn |
Data Breach Notification
In the event of a security breach affecting your personal data, Patriy will:
Notify within 72 hours
We'll notify data protection authorities and affected users within 72 hours of discovering the breach.
Provide full details
What data was affected, what happened, measures taken, and who to contact for more information.
Take corrective action
We'll investigate, contain the breach, and implement preventive measures immediately.
Data Processing Agreements (DPA)
As required by GDPR Article 28, Patriy provides Data Processing Agreements for:
- Enterprise customers
- Customers processing EU residents' data
- Customers requiring formal compliance documentation
Our DPA covers:
- Data subject rights
- Sub-processor management
- Data security measures
- Audit and compliance rights
- International data transfers
To request a DPA: hello@patriy.com
Privacy by Design
🔒 Data Minimization
We collect only data necessary to provide the Service. No unnecessary data collection.
🎯 Purpose Limitation
Data is used only for stated purposes. No secondary uses without consent.
🔐 Storage Limitation
Data is retained only as long as necessary. Automatic deletion after retention periods.
🛡️ Integrity & Confidentiality
Encryption, access controls, and regular security audits protect your data.
Data Protection Authority
If you believe your GDPR rights have been violated, you can file a complaint with your local data protection authority:
Uganda: Uganda Communications Commission (UCC)
EU Residents: Your national data protection authority (e.g., CNIL for France; the ICO for the UK)
Questions About GDPR?
Our Data Protection Officer is available to help:
Email: hello@patriy.com
WhatsApp
Response time: Within 48 hours