GDPR Compliance

Last updated: October 2, 2025

Our Commitment to Data Protection

SkillStory is committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR). This page outlines how we comply with GDPR requirements and what rights you have regarding your personal data.

What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all companies processing personal data of individuals in the European Union, regardless of where the company is located.

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

1. Right to Information

You have the right to be informed about how we collect, use, and process your personal data. This information is provided in our Privacy Policy.

2. Right of Access

You can request access to your personal data and receive information about how we process it. This includes the right to obtain a copy of your personal data.

3. Right to Rectification

You can request that we correct any inaccurate or incomplete personal data we hold about you.

4. Right to Erasure (Right to be Forgotten)

You can request that we delete your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

5. Right to Restrict Processing

You can request that we restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data.

6. Right to Data Portability

You can request that we provide your personal data in a structured, commonly used, and machine-readable format, and you can request that we transfer this data to another controller.

7. Right to Object

You can object to the processing of your personal data for direct marketing purposes or when processing is based on legitimate interests.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affects you.

How We Process Your Data

Legal Basis for Processing

We process your personal data based on the following legal grounds:

  • Consent: When you explicitly agree to our processing activities
  • Contract: When processing is necessary to fulfill our services
  • Legal Obligation: When required by law
  • Legitimate Interest: When necessary for our business interests (balanced against your rights)

Data Minimization

We only collect and process personal data that is necessary for the specific purposes outlined in our Privacy Policy. We regularly review our data collection practices to ensure compliance.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or resolve disputes.

International Data Transfers

When we transfer your personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

  • Standard Contractual Clauses approved by the European Commission
  • Adequacy decisions for countries with adequate data protection
  • Certification schemes and codes of conduct
  • Binding corporate rules for transfers within corporate groups

Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

  • Encryption of data in transit and at rest
  • Regular security assessments and penetration testing
  • Access controls and authentication measures
  • Staff training on data protection and security
  • Incident response and data breach notification procedures

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us using the information below. We will respond to your request within one month (extendable by two additional months for complex requests).

Submit a Data Subject Request

To help us process your request efficiently, please include:

  • Your full name and email address
  • A clear description of your request
  • Verification of your identity (if required)
  • Any relevant account or reference numbers

Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our compliance with GDPR and handle data protection matters. You can contact our DPO directly:

Data Protection Officer
Email: dpo@skillstory.ai
Address: SkillStory Data Protection Office
123 Innovation Drive
San Francisco, CA 94105

Supervisory Authority

If you believe that our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where:

  • You habitually reside
  • You work
  • The alleged infringement took place

You can find contact information for EU supervisory authorities at:European Data Protection Board

Contact Information

For any questions about GDPR compliance or to exercise your rights, please contact us:

Privacy Team: privacy@skillstory.ai
Data Protection Officer: dpo@skillstory.ai
General Support: support@skillstory.ai
Phone: +1 (555) 123-4567
Address: SkillStory GDPR Compliance Team
123 Innovation Drive
San Francisco, CA 94105