GDPR Compliance Statement

1. Data Controller Information

Data Controller: Qubixel Technologies Private Limited
Email: dpo@shoutlyai.com
Address: JP Nagar 8th Phase, Karnataka 560083, India

2. Legal Bases for Processing (Article 6)

• Contract (Article 6(1)(b)): Processing necessary for the performance of our Service agreement with you
• Legitimate Interests (Article 6(1)(f)): Improving our Service, fraud prevention, direct marketing (with opt-out)
• Consent (Article 6(1)(a)): Marketing communications, non-essential cookies
• Legal Obligation (Article 6(1)(c)): Tax, regulatory, and legal compliance

3. Your Rights Under GDPR (Articles 15-22)

• Right to Access (Article 15): Obtain confirmation of whether your data is processed and receive a copy
• Right to Rectification (Article 16): Correct inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your data ("Right to be forgotten")
• Right to Restrict Processing (Article 18): Limit how we use your data while disputes are resolved
• Right to Data Portability (Article 20): Receive your data in a machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing
• Rights Related to Automated Decision-Making (Article 22): Not be subject to solely automated decisions with legal effects

4. How to Exercise Your Rights

To exercise any of these rights, contact our Data Protection Officer (DPO) at dpo@shoutlyai.com. We will respond within 30 days (extendable by 60 days for complex requests).

To verify your identity, we may request additional information. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.

5. Data Protection Officer (DPO)

We have appointed a Data Protection Officer who can be contacted at:

• Email: dpo@shoutlyai.com
• Address: DPO, Qubixel Technologies Private Limited, JP Nagar 8th Phase, Karnataka 560083, India

6. International Data Transfers

Your data may be transferred to countries outside the EEA (including India and the United States). For such transfers, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework (for transfers to certified US entities)

7. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours as required by Article 33 of the GDPR. If the breach poses a high risk to your rights, we will also notify you without undue delay.

8. Supervisory Authority & Right to Lodge Complaint

If you believe our processing of your data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority. For example:

• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Ireland: Data Protection Commission - dataprotection.ie
• Germany: Bundesbeauftragter für den Datenschutz - bfdi.bund.de