GDPR Compliance & Data Protection

EU / UK GDPR SUPPLEMENT

European Union and United Kingdom privacy, rights, breach, transfer and child-data rules

Academic Quality. Verified.

1. Application

This Supplement applies where the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR, the UK Data Protection Act 2018 or related applicable data-protection law governs Veri-AQ processing. It supplements the Master Privacy Notice and the other jurisdiction-specific policies. Territorial scope must be assessed against the actual offering, monitoring, establishment and data-subject facts before launch in a new European market.

2. Lawful bases

Veri-AQ must document an Article 6 lawful basis for each purpose. Where special-category data is processed, an applicable Article 9 condition must also be recorded. Consent is used only where it is appropriate and must be freely given, specific, informed, unambiguous and withdrawable where relied upon.

3. Children and digital consent

Where consent is relied upon for an information-society service offered directly to a child, the applicable Article 8 age must be determined from the user’s jurisdiction. Under the EU GDPR the default age is 16, but Member States may lower it to no less than 13. The UK age is 13. Veri-AQ must apply the relevant country rule rather than assume one Europe-wide threshold, and must obtain or verify parental-responsibility authorisation where required.

• Age-appropriate privacy information and high-privacy defaults apply to child users.
• Junior and Home School privacy, guardian visibility, retention and consent rules continue to apply unless a stricter applicable rule requires more protection.
• High-risk child processing must be included in the applicable DPIA assessment.

4. Data-subject rights and response timing

Subject to applicable law and exceptions, rights include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and rights relating to qualifying automated decision-making under Article 22. Under EU GDPR Article 12(3), Veri-AQ must respond without undue delay and in any event within one month of receipt; where necessary because of complexity or number of requests, that period may be extended by two further months, with the data subject informed of the extension and reasons within the original one-month period. The corresponding UK statutory timing must be applied to UK requests.

5. Automated decision-making

Veri-AQ academic indicators are advisory. Where Article 22 or the corresponding UK rule applies to a solely automated decision producing legal or similarly significant effects, Veri-AQ or the relevant controller must document the lawful condition and provide the safeguards required by law, including appropriate human intervention, the opportunity to express a view and a route to contest the decision.

6. Personal-data breach notification

EU GDPR Article 33 requires a controller to notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. If notification is later than 72 hours, reasons for delay must accompany it. Article 34 is different: affected data subjects are informed without undue delay where the breach is likely to result in a high risk, subject to the statutory exceptions. Veri-AQ must not describe the 72-hour supervisory-authority deadline as a universal deadline for notifying every affected person or every jurisdiction. UK incidents must follow the applicable UK GDPR/ICO rule.

7. International transfers

EEA restricted transfers must satisfy GDPR Chapter V. Veri-AQ must document an applicable adequacy decision, appropriate safeguard such as the European Commission Standard Contractual Clauses (SCCs), or another lawful mechanism. Where SCCs are used, the applicable module, annexes, transfer impact assessment and supplementary measures must be completed. UK restricted transfers must use the applicable UK mechanism, which may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU SCCs, adequacy regulations or another lawful safeguard.

8. Representatives

Where Article 27 requires an EU/EEA representative because Veri-AQ is subject to the GDPR without an EU establishment, the representative must be appointed in writing and its details published. [VERIFY: EU/EEA Article 27 representative appointed, if required — name and address].

Where UK GDPR territorial scope requires a UK representative and no UK establishment removes that requirement, the representative details must be documented and published. [VERIFY: UK representative appointed, if required — name and address].

9. Supervisory authority and complaints

An individual may complain to the supervisory authority available under the GDPR, including in the Member State of habitual residence, place of work or alleged infringement as applicable. A lead supervisory authority must not be claimed before the establishment and cross-border-processing facts support one. [VERIFY: EU/EEA establishment and competent or lead supervisory authority, if applicable]. UK complaints may be made to the Information Commissioner’s Office (ICO).

10. Relationship to POPIA and other laws

A processing activity may be subject to POPIA and EU or UK data-protection law at the same time. Veri-AQ must identify and satisfy each applicable regime. Where requirements can be complied with simultaneously, Veri-AQ applies the more protective applicable requirement; where rules conflict, qualified legal review is required before processing proceeds.

11. Current Veri-AQ positions

• Veri-AQ does not currently operate a global cross-customer repository of user submissions or document fingerprints.
• Veri-AQ does not currently use user-submitted academic content, AI Tutor conversations, prompts or reports for general AI-model training.
• Dormant consent-schema switches do not authorise processing and remain default off until a future purpose has completed the required assessment, policy update and affirmative opt-in process.

Legal review and mandatory-law notice

Legal review and mandatory-law notice. This policy framework is designed for Veri-AQ operations and must be reviewed by appropriately qualified counsel before a new entity, jurisdiction, school contract, under-13 U.S. workflow or materially new processing purpose is launched. Nothing in this document excludes rights or duties that applicable law does not permit the parties to waive.

Primary legal references

EU GDPR (Regulation (EU) 2016/679) — https://eur-lex.europa.eu/eli/reg/2016/679/oj

UK Data Protection Act 2018 — https://www.legislation.gov.uk/ukpga/2018/12/contents

ICO UK GDPR guidance — https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/

European Commission SCCs — https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en

Contact details

Website: www.veri-aq.com | Support: support@veri-aq.com | Privacy / PAIA: privacy@veri-aq.com

Principal address: Hofmeyer Rd, Centurion, South Africa, 0157