GDPR Compliance

Our Commitment to Data Protection

Karven is fully committed to compliance with the General Data Protection Regulation (GDPR). As a European company serving European businesses, data protection is at the core of how we operate. We believe strong data practices are not just a legal requirement but a foundation of trust with our clients.

How We Process Data

We process personal data only when we have a lawful basis to do so:

Contract Performance: Processing necessary to deliver our consulting services
Legitimate Interest: Business operations and improvement, balanced against your rights
Consent: Marketing communications and optional data collection
Legal Obligation: Compliance with applicable laws and regulations

Your Rights Under GDPR

The GDPR grants you significant rights over your personal data. We respect and facilitate all of these rights:

Right to Access

You can request a copy of the personal data we hold about you.

Right to Rectification

You can ask us to correct any inaccurate or incomplete personal data.

Right to Erasure

You can request deletion of your personal data in certain circumstances.

Right to Restriction

You can ask us to limit how we use your data while we verify or correct it.

Right to Portability

You can receive your data in a structured, machine-readable format.

Right to Object

You can object to processing of your data for direct marketing or legitimate interests.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

Data We Collect

We collect only the data necessary for our business purposes:

Identity Data: Name, job title, company
Contact Data: Email address, phone number, business address
Technical Data: IP address, browser type, usage patterns
Engagement Data: Project details, communications, deliverables

Data Security

We implement appropriate technical and organizational measures to protect personal data:

Encryption of data in transit and at rest
Access controls and authentication requirements
Regular security assessments and updates
Employee training on data protection
Incident response procedures

Data Transfers

We primarily process data within the European Economic Area (EEA). When data transfer outside the EEA is necessary, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

Data Retention

We retain personal data only as long as necessary for the purposes collected. Our standard retention periods are:

Contact inquiries: 2 years from last interaction
Client engagement data: 7 years (legal/accounting requirements)
Website analytics: 26 months
Marketing data: Until consent withdrawn

For Our Clients

When we process data on behalf of clients during AI implementation projects, we act as a data processor. We sign Data Processing Agreements (DPAs) that outline our obligations, including confidentiality, security measures, sub-processor restrictions, and cooperation with data subject requests.

Exercising Your Rights

To exercise any of your GDPR rights, contact our Data Protection team:

Email: privacy@karven.ai
Subject: GDPR Request

We will respond to your request within 30 days. If your request is complex, we may extend this by up to two months, but we will inform you of any extension within the first month.

Supervisory Authority

If you are unsatisfied with our handling of your data, you have the right to lodge a complaint with a supervisory authority. For Monaco-based operations, the relevant authority is the Commission de Contrôle des Informations Nominatives (CCIN).

Updates to This Policy

We review our GDPR compliance practices regularly and may update this page to reflect changes. Significant changes will be communicated directly to affected parties.