GDPR
Effective date: 11 October 2026. Controller contact: privacy@genloft.io.
1. GDPR posture
GENLOFT is designed with privacy and security controls that support GDPR compliance for EU/EEA users: consent-first cookies, access control, auditability, and data minimisation on the marketing surface.
2. Roles
- Controller for this marketing site: GENLOFT.
- Processor role applies when we process customer personal data on behalf of business customers — covered by a data processing agreement at signup.
3. Lawful bases
See Privacy Policy §4. Marketing analytics require consent. Contact handling uses contract steps / legitimate interest. Security logging uses legitimate interest.
4. Technical and organisational measures (summary)
- Single sign-on and least-privilege access controls
- Secrets management and encrypted transport (TLS)
- Network deny-by-default patterns and edge web application firewall
- Tenant isolation with automated regression checks
- Security monitoring and audit trails
5. Data subject requests
Email dpo@genloft.io or privacy@genloft.io. We aim to respond within 30 days.
6. Breach notification
Incidents affecting personal data are assessed under applicable breach-notification rules.
7. Cookies and consent
See Cookie Policy. Default = essential only until you opt in.