GDPR Compliance

1. Our Commitment to GDPR

ManArch, operated by diRectly2you ltd., is fully committed to compliance with the General Data Protection Regulation (GDPR). We have implemented comprehensive measures to ensure that all personal data processed through our AI-Native Enterprise Architecture Copilot is handled with the highest standards of privacy and security.

2. Data Residency

All your data is stored and processed exclusively within the European Union. We maintain strict data residency controls:

• Primary data storage in EU-based data centers
• Backup and disaster recovery systems located within the EU
• No data replication outside EU boundaries

Sub-processors:

• Cloudflare — Edge network and DDoS protection (EU regions)
• Clerk — Authentication with EU data processing

3. Data Protection Measures

Technical Safeguards:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls with multi-factor authentication
• Firewalls, intrusion detection, and DDoS protection
• IP address anonymization in logs

Organizational Measures:

• Regular employee security training
• Data protection impact assessments
• Documented security policies and procedures
• Incident response procedures
• Regular third-party security audits

4. Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of Access — Request a copy of your personal data
• Right to Rectification — Correct inaccurate personal data
• Right to Erasure — Request deletion of your personal data
• Right to Restriction — Limit how we process your data
• Right to Data Portability — Receive your data in a portable format
• Right to Object — Object to certain types of processing

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

5. Lawful Basis for Processing

We process personal data based on the following lawful grounds:

• Contract Performance (Article 6(1)(b)) — Processing necessary to deliver our services
• Consent (Article 6(1)(a)) — Where you have given explicit consent
• Legitimate Interest (Article 6(1)(f)) — For service improvement and security
• Legal Obligation (Article 6(1)(c)) — To comply with applicable laws

6. Data Processing Agreement

For our B2B clients, we provide comprehensive Data Processing Agreements (DPAs) that cover:

• Scope and nature of processing activities
• List of authorized sub-processors
• Technical and organizational security measures
• Data breach notification procedures
• Audit rights and cooperation obligations
• Data deletion and return protocols

To request a DPA, contact us at [email protected].

7. Cookies & Tracking

We use only essential cookies that are strictly necessary for the operation of our service. These include authentication tokens, security cookies, and load balancing cookies. We do not use any tracking, advertising, or cross-site analytics cookies.

8. Data Breach Procedures

In the event of a data breach, we follow a strict response protocol:

• Containment and assessment within 24 hours
• Notification to the relevant supervisory authority within 72 hours
• Immediate notification to affected data subjects when required
• Full documentation of the breach and response actions
• Post-incident review and security improvements

9. International Transfers

We do not transfer personal data outside the European Economic Area (EEA). All our infrastructure, sub-processors, and backup systems are located within the EU, ensuring your data remains protected under EU data protection laws at all times.

10. Data Retention

We retain personal data only for as long as necessary:

• Account data: Duration of account plus 30 days after deletion
• Usage logs: 90 days, then anonymized
• Support tickets: 2 years after resolution
• Billing records: As required by tax law (typically 7 years)
• Waitlist data: Until service launch or deletion request

11. AI & Your Data

Your data is never used to train AI models. When you use ManArch's AI-powered features, your data remains strictly isolated within your organization. There is no cross-customer data sharing, and your architecture models, documents, and queries are never used to improve our AI systems or shared with third parties.

12. Contact Information

For any GDPR-related inquiries, please reach out to us:

• Privacy inquiries: [email protected]
• DPA requests: [email protected]
• General inquiries: [email protected]

13. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with your local supervisory authority. For users in Slovakia, the relevant authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), based in Bratislava.