GDPR Policy

Effective Date: October 4, 2026

The General Data Protection Regulation (GDPR) is the European Union's principal privacy and personal-data protection law. It became applicable on 25 May 2018 and is incorporated into the EEA framework. Although it is an EU/EEA regulation, its practical impact is global because organizations outside Europe can also fall within its scope.

A key point is that GDPR is not literally a worldwide privacy law. Rather, it has extraterritorial reach: an organization located anywhere in the world may have to comply when its processing falls within Article 3 of the GDPR.

1. Who does GDPR apply to?

GDPR can apply to an organization in three major situations:

• The organization is established in the EU/EEA and processes personal data in connection with that establishment.
• The organization is outside the EU/EEA but offers goods or services to people in the EU/EEA.
• The organization is outside the EU/EEA but monitors the behavior of individuals while they are in the EU/EEA.

For example, a company headquartered in the United States, India, Japan, Singapore, Australia, or Canada may still need to comply with GDPR if it deliberately offers services to people in the EU or tracks their behavior there.

Simply having a website that can technically be accessed from Europe does not automatically mean the company is subject to GDPR. The nature of the company's activities and whether they target or monitor people in the EU/EEA matters.

2. What is personal data?

GDPR takes a broad approach to personal data. Personal data can include:

• Name
• Email address
• Telephone number
• Home or business address
• IP address
• Online identifiers
• Cookie identifiers
• Location information
• Account or customer IDs
• Employee information
• Device information
• Photos and videos
• Financial information
• Health information
• Genetic or biometric information
• Information about preferences or behavior

The GDPR definition covers information relating to an identified or identifiable natural person, including identifiers such as names, identification numbers, location data, and online identifiers.

Special categories

Some information receives additional protection, including information concerning:

• Health
• Genetics
• Biometrics used for uniquely identifying someone
• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade-union membership
• Sex life or sexual orientation

Organizations therefore need stronger justification and safeguards when processing these categories.

3. Core GDPR principles

A worldwide organization seeking GDPR compliance should build its privacy program around the GDPR's fundamental principles.

Lawfulness, fairness and transparency

An organization must have a lawful basis for processing personal data and must be transparent about what it is doing. For example, a company should explain what information is collected, why it is collected, how it is used, who receives it, how long it is retained, and what rights the individual has.

Purpose limitation

Data should be collected for specific, explicit and legitimate purposes. For example, collecting an email address to create a customer's account does not automatically mean the company can use that address for unrelated marketing.

Data minimization

Organizations should collect only information that is necessary and relevant to the stated purpose. Instead of collecting 20 pieces of information when only 5 are necessary, the organization should minimize the collection.

Accuracy

Personal data should be accurate and, where necessary, kept up to date.

Storage limitation

Organizations should not keep personal data indefinitely without justification. A company should establish retention periods and deletion procedures.

Integrity and confidentiality

Personal data must be protected using appropriate security measures. This can include encryption, access controls, authentication, logging, monitoring, backups, security testing, incident-response procedures, employee training, and other safeguards.

Accountability

It is not enough for an organization to say "we comply with GDPR." The organization must be able to demonstrate compliance through documentation, policies, controls, records, training, monitoring, and evidence of governance.

4. Lawful bases for processing

GDPR requires a lawful basis before processing personal data. Common bases include:

• Consent
• Contract performance
• Legal obligation
• Vitally important interests
• Public task
• Legitimate interests

Consent must be freely given, specific, informed, and unambiguous in many contexts. Legitimate-interest processing must be balanced against the rights and expectations of the data subject.

5. Privacy notices and transparency

Organizations must provide clear information to individuals about data processing. A good privacy notice should explain:

• What data is being collected
• Why it is collected
• How it is used
• Who receives it
• Whether it is transferred outside the EEA
• How long it is stored
• What rights the individual has
• How to contact the organization

6. Data subject rights

GDPR gives individuals rights over their personal data, including the right to:

• Access their personal data
• Rectify inaccurate data
• Erase data in certain circumstances
• Restrict processing
• Object to processing
• Data portability
• Not be subject to automated decision-making without meaningful human involvement

Organizations must respond to requests within statutory deadlines and may need to verify identity before disclosing or changing personal data.

7. International transfers

GDPR restricts transfers of personal data outside the EEA. Where data is sent to a country without an adequacy decision, organizations must use an appropriate transfer mechanism, such as:

• Standard contractual clauses
• Binding corporate rules
• Certification or other approved safeguards where available

Organizations should also assess whether the recipient country provides an adequate level of protection and whether additional safeguards are needed.

8. Security and breach response

GDPR requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Personal data breaches must generally be assessed and, where required, reported to the relevant supervisory authority within the prescribed timeframe. In some cases, affected individuals may also need to be notified.

Key elements of a breach-response process include:

• Breach detection and triage
• Containment and investigation
• Risk assessment
• Notification processes
• Lessons learned and remediation

9. Accountability and governance

GDPR is not only about forms and checkboxes. It is about governance.

A practical compliance program may include:

• Data inventory and processing records
• Privacy notices and lawful-basis documentation
• Retention schedules
• Vendor and processor management
• Records of processing activities
• Training for staff
• Privacy impact assessments
• Policies for data subject requests and incident response

10. DPO and supervisory authorities

Some organizations may need to appoint a Data Protection Officer (DPO) depending on the nature of their processing and legal requirements. Certain organizations may also be subject to oversight by national data-protection authorities within the EEA.

Where mandatory requirements apply, an organization should understand which supervisory authority has competence and what reporting or cooperation duties exist.

11. Practical guidance for global businesses

For a company operating internationally, a practical GDPR approach includes:

• Mapping personal-data flows and processing activities.
• Checking whether the company targets or monitors individuals in the EEA.
• Identifying the lawful basis for each processing activity.
• Reviewing contracts with processors and vendors.
• Testing privacy notices and rights-handling procedures.
• Putting in place security and breach-response standards.
• Reviewing international transfers and cross-border data movement.
• Documenting decisions and evidence of compliance.

12. Contact

For GDPR-related privacy questions, requests, or rights inquiries, contact:

MaxX Holdings Inc.
Email: info@maxxholdingsinc.us
Website: https://maxxholdingsinc.us
Address: 30 N Gould St, Ste R, Sheridan, WY 82801, United States