GDPR Center
Your rights under the EU General Data Protection Regulation, and how to exercise them.
Quick Actions
Your rights under GDPR
Right to Access (Art. 15)
Request a copy of all personal data we hold about you.
Right to Rectification (Art. 16)
Correct inaccurate or incomplete data — directly editable in your account.
Right to Erasure (Art. 17)
Request that we delete your personal data ('right to be forgotten').
Right to Restrict Processing (Art. 18)
Limit how we use your data while a query is being resolved.
Right to Data Portability (Art. 20)
Download your data in a structured, machine-readable format (JSON).
Right to Object (Art. 21)
Object to processing based on legitimate interests, including marketing.
Data retention
| Data category | Retention period |
|---|---|
| Account profile | Until account deletion + 30 days backup |
| Contact exchanges | Until you delete the contact |
| Analytics events | 14 months, then aggregated |
| Newsletter subscribers | Until unsubscribe + 30 days |
| Order & invoice data | 10 years (legal/tax requirement) |
| Support tickets | 3 years after closure |
| Consent log | 5 years (proof of consent) |
Legal basis for processing
- Contract (Art. 6(1)(b)) — providing the service you signed up for: account, profile hosting, NFC card linking, payments.
- Legitimate interests (Art. 6(1)(f)) — fraud prevention, service improvement, security logging.
- Consent (Art. 6(1)(a)) — marketing emails, retargeting pixels, optional analytics.
- Legal obligation (Art. 6(1)(c)) — invoice retention, tax compliance, lawful requests from authorities.
Recipients, connected platforms and international transfers
PeersUp uses infrastructure, payment, email, push-notification, connected communication, calendar and AI/research providers to deliver requested features. Optional providers receive data only when the relevant integration or feature is used.
Depending on the service, a provider may act as our processor, as an independent controller, or under platform-specific data processing terms. Current providers and their roles are listed on our Sub-processors & Connected Service Providers page.
Where a restricted transfer outside the EEA occurs, PeersUp relies on the transfer mechanism applicable to that provider and service, such as an adequacy decision, Standard Contractual Clauses or the EU-US Data Privacy Framework where valid and applicable.
Related documents
Contact our privacy team
For any GDPR-related question, request, or complaint:
Email: privacy@peersup.com
Response time: within 30 days (GDPR Art. 12(3))
You also have the right to lodge a complaint with your local supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. Contact info@aki.ee or visit aki.ee. A list of EU authorities is available at edpb.europa.eu.