GDPR Compliance Portal

1. Regulatory Scope & Applicability

This GDPR Portal governs all personal data processing activities conducted by KyrosB2B involving European data subjects, including corporate subscribers, platform visitors, whitepaper downloaders, and campaign participants across our 20+ digital publishing properties reaching 88M+ decision-makers globally.

2. Data Controller vs. Processor Designations

Pursuant to Article 4(7) and Article 4(8) of the GDPR, KyrosB2B fulfills distinct legal roles based upon campaign architecture:

• Data Controller: KyrosB2B acts as Data Controller when collecting first-party subscriber records, managing digital publishing newsletters, administering web platform telemetry, and determining processing purposes for our proprietary audience databases.
• Data Processor / Joint Controller: Under custom client demand generation, Cost-Per-Lead (CPL), and content syndication programs, KyrosB2B acts as Data Processor or Joint Controller according to executed Data Processing Addendums (DPAs) incorporating European Commission Standard Contractual Clauses.

3. Lawful Processing Bases (Article 6 & Recital 47)

KyrosB2B strictly mandates that every personal data processing activity is justified under an explicit lawful basis set forth in GDPR Article 6(1):

4. First-Party Opt-In Capture & Zero Third-Party Scraping

KyrosB2B warrants that 100% of European subscriber data is collected through explicit first-party interactions across our owned media properties. Each registration logs cryptographic double opt-in confirmation hashes, IP addresses, timestamp signatures, and exact form consent text.

Anti-Scraping Guarantee: KyrosB2B prohibits the acquisition, ingestion, or processing of web-scraped databases or unverified third-party contact lists.

5. Strict Adherence to Article 5 Data Protection Principles

All processing across KyrosB2B systems adheres strictly to the core principles of GDPR Article 5(1):

• Lawfulness, Fairness & Transparency: Transparent processing supported by comprehensive privacy disclosures.
• Purpose Limitation: Collected solely for specified B2B demand generation and publishing purposes.
• Data Minimization: Restricted to professional B2B attributes (Name, Work Email, Job Title, Company Name).
• Accuracy: Multi-step email verification and automated phone scrubbing routines.
• Storage Limitation: 24-month inactive profile suppression governance schedules.
• Integrity & Confidentiality: Technical TOMs encryption standards.

6. Data Subject Access Rights (Articles 15–22)

European Union and United Kingdom business professionals possess fundamental statutory data rights under Articles 15-22 of the GDPR:

7. DSAR Execution & 30-Day SLA Verification Protocol

Data Subject Access Requests (DSARs) are handled free of charge and processed within thirty (30) calendar days. KyrosB2B enforces strict identity verification to prevent unauthorized data disclosures.

8. International Data Transfers & Standard Contractual Clauses (SCCs)

Transfers of European personal data to countries outside the EEA/UK lacking an adequacy decision are governed by European Commission Standard Contractual Clauses (2021/914 SCCs Module 1 & Module 2) and the UK IDTA, supported by Data Transfer Impact Assessments (DTIAs).

9. Security TOMs (Article 32) & 72-Hour Breach Notifications

KyrosB2B maintains Technical and Organizational Measures (TOMs) including TLS 1.3 encryption in transit, AES-256 encryption at rest, and SOC 2 Type II controls. Under GDPR Article 33, any confirmed personal data breach will be reported to competent Supervisory Authorities within 72 hours.

10. Sub-Processor Governance (Article 28)

KyrosB2B engages vetted third-party sub-processors (cloud hosting providers, CRM webhook connectors, and verification APIs) bound under mandatory Article 28 Data Processing Agreements. A complete sub-processor register is available upon request by enterprise clients.

11. Data Protection Impact Assessments (DPIA - Article 35)

KyrosB2B regularly conducts Data Protection Impact Assessments (DPIAs) overseen by our DPO to evaluate and mitigate privacy risks associated with automated intent processing and media distribution campaigns.

12. Data Protection Officer (DPO) & Supervisory Authority Recourse

For GDPR inquiries or supervisory communications, contact our dedicated Data Protection Office:

European Union and UK Data Subjects have the right to lodge a formal complaint with their respective national Lead Supervisory Authority (e.g., Information Commissioner's Office - ICO in the UK, CNIL in France, or AP in the Netherlands).