GDPR Compliance

1. Roles and responsibility

EuroSMM, E. Shaman, is the Cametas project operator and generally acts as controller for project administration, support, and decisions about the service. Codepolder / Reprevi is the technical developer and may act as a processor for documented development or maintenance work, or as a separate controller where it independently determines a processing purpose required by law. App stores, payment platforms, and other external providers may be independent controllers.

2. GDPR principles

• Lawfulness, fairness, and transparency: processing should have an identified basis and be explained in accessible language.
• Purpose limitation: information should not be repurposed incompatibly without a new basis or notice.
• Data minimisation: only information reasonably relevant to a feature, obligation, or request should be used.
• Accuracy: reasonable steps should be available to correct relevant information.
• Storage limitation: retention should follow an operational or legal need rather than being indefinite by default.
• Integrity and confidentiality: safeguards should reflect the sensitivity and risk of the information.
• Accountability: the responsible party should be able to explain the decisions and measures it applies.

3. Lawful bases and consent

Processing may be necessary to perform the user agreement, comply with a legal obligation, or pursue a proportionate legitimate interest such as security, fraud prevention, service reliability, and handling claims. Consent is used where a freely given and specific choice is appropriate, including for optional cookies where required. Device permission is an operating-system control and does not by itself replace a GDPR lawful-basis assessment. Consent can be withdrawn for future use without affecting processing that was lawful before withdrawal.

4. Data protection rights

Depending on the circumstances and applicable exceptions, a data subject may:

• obtain confirmation and access to personal data;
• correct inaccurate or incomplete information;
• request erasure or restriction of processing;
• object to processing based on legitimate interests or to direct marketing;
• receive eligible information in a structured, commonly used, machine-readable format;
• withdraw consent and adjust optional cookie choices;
• request safeguards relevant to an international transfer; and
• lodge a complaint with the supervisory authority in the person’s habitual residence, place of work, or place of an alleged infringement.

5. How to submit a request

Send the request to [email protected] with the subject “Data Protection Request”. Describe the Cametas interaction, the right you wish to exercise, the approximate date, and the email or transaction reference involved. Do not send passwords, full payment-card details, or unnecessary identity documents. We may ask for proportionate verification where needed to protect another person’s information.

A complete request is normally addressed within one month as required by Article 12 GDPR. That period may be extended by up to two further months for a complex or numerous request, with notice of the reason. A request is generally free of charge, although a manifestly unfounded or excessive request may be refused or charged where the GDPR permits.

6. Local data and limits of a request

If a recording or script exists only on a user-controlled device and has never been transmitted to a Cametas-controlled system, the project cannot access, export, correct, or delete that file. The relevant right can instead be exercised directly with the device’s file, permission, backup, or uninstall controls. We will explain this distinction where a request concerns information the project cannot reasonably identify or possess.

7. Processors, transfers, and safeguards

A service provider handling personal data on behalf of the controller should be subject to instructions, confidentiality, appropriate security, and the data-processing terms required by Article 28 GDPR. Transfers from the EEA to a country without an adequacy decision should use an available safeguard such as the European Commission’s standard contractual clauses, together with supplementary measures where the circumstances require them.

8. Security and incident response

Measures may include access limitation, secure configuration, updates, encryption where suitable, provider review, logging, backup controls, and incident procedures. Risks are reviewed in proportion to the nature, scope, context, and purpose of processing. If a personal-data breach creates the threshold of risk specified by GDPR, the controller will notify the competent supervisory authority and affected individuals within the applicable requirements.

9. Records, assessments, and privacy enquiries

The project may maintain proportionate records of processing, retention, providers, and security decisions. A data protection impact assessment is considered before processing that is likely to create a high risk to individuals. No formally designated Data Protection Officer is represented unless such an appointment is separately announced. All privacy and GDPR enquiries are nevertheless handled through [email protected].