How Value Adders World protects the rights of EU data subjects under the General Data Protection Regulation
Value Adders World is committed to protecting personal data in accordance with the General Data Protection Regulation (EU) 2016/679. We process personal data lawfully, fairly, and transparently.
The data controller for personal data processed through our services is:
We process personal data under the following legal bases as defined in Article 6 of the GDPR:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Providing AI agent services | Performance of contract | Art. 6(1)(b) |
| Account management | Performance of contract | Art. 6(1)(b) |
| Billing and invoicing | Performance of contract / Legal obligation | Art. 6(1)(b), (c) |
| Security and fraud prevention | Legitimate interest | Art. 6(1)(f) |
| Service improvement | Legitimate interest | Art. 6(1)(f) |
| Marketing communications | Consent | Art. 6(1)(a) |
| Legal compliance | Legal obligation | Art. 6(1)(c) |
As an EU data subject, you have the following rights:
Request a copy of all personal data we hold about you (Article 15)
Correct any inaccurate or incomplete personal data (Article 16)
Request deletion of your personal data ("right to be forgotten") (Article 17)
Limit how we process your data in certain circumstances (Article 18)
Receive your data in a machine-readable format (Article 20)
Object to processing based on legitimate interest (Article 21)
Withdraw consent at any time where consent is the legal basis (Article 7)
Not be subject to solely automated decisions with legal effects (Article 22)
Our AI agents make decisions and take actions on your behalf. Under Article 22 of GDPR, you have rights regarding automated decision-making.
Our AI agents do not make decisions with significant legal or similarly significant effects without human oversight. All high-impact decisions can be configured to require human approval.
Our primary data processing occurs in the EU. When we transfer data outside the EU/EEA, we ensure adequate protection through:
| Sub-Processor | Location | Purpose | Safeguard |
|---|---|---|---|
| OpenAI | United States | AI model inference | SCCs + DPA |
We retain personal data only as long as necessary for the purposes collected:
| Data Category | Retention Period | Justification |
|---|---|---|
| Account data | Duration of account + 30 days | Contract performance |
| Agent operational data | Configurable (default 90 days) | Service provision |
| Audit logs | 2 years | Security / legitimate interest |
| Billing records | 7 years | Legal obligation (tax law) |
In accordance with Article 32 of GDPR, we implement appropriate technical and organizational measures to ensure security:
For detailed security information, see our Security Whitepaper.
In the event of a personal data breach, we will:
When we act as a data processor on behalf of customers (e.g., processing your customer data through our AI agents), we enter into Data Processing Agreements (DPAs) that include:
To request a DPA, contact privacy@addvalue.ai.
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with a supervisory authority.
For any GDPR-related questions or to exercise your rights:
Email: privacy@addvalue.ai
Response Time: Within 30 days
We're committed to transparent, lawful data processing. Don't hesitate to reach out.