GDPR Compliance

Overview of our GDPR compliance measures and data protection practices

Legal Documents

Our privacy and usage agreements under GDPR Art. 13/14

Privacy Policy

Data collection, legal bases, and your rights as a data subject

Terms of Service

Contractual foundations, responsibilities, and GDPR compliance clauses

Data Processing Agreement (DPA)

Art. 28 GDPR – incl. TOMs, retention schedules, sub-processor list, and data transfers

Privacy & Control

Manage your data preferences and exercise your data subject rights

Privacy Settings

All privacy controls in one place – cookies, consents, and data subject rights

Cookies & Tracking

Manage or withdraw consent for cookies and tracking services. Cookieless analytics via Rybbit require no consent.

Data Subject Rights

Request access, rectification, erasure, or data portability (Art. 15–20 GDPR). Response within 30 days.

Security & Transparency

Technical and organizational measures (TOMs) under Art. 32 GDPR

Security Architecture & TOMs

Full TOM documentation is included as an annex in the Data Processing Agreement

Technical Measures

Data encryption (transit & rest)
Multi-factor authentication (MFA)
Role-based access controls
30-day recovery window
Automated data lifecycle management

Incident Response

Automated breach detection
Real-time security monitoring
72-hour notification (supervisory authority)
Direct notification of affected users
Regulatory authority reporting

Data Transfers

Scheduling/employee data in EU (Supabase Frankfurt)
Only billing metadata to Stripe (US, DPF + SCCs)
Standard Contractual Clauses (SCCs)
Third-country transfers minimized
Sub-processor list in DPA

Contact Information

Data Protection Contact

📧 support@monkaru.com

🏢 Vienna, Austria

Need Help? If you have questions about your data or our GDPR compliance, please don't hesitate to contact our Data Protection Officer. We're here to help you exercise your rights and ensure your data is handled appropriately.