ClassEngine.eu
←Back to Home
Legal

GDPR Statement

Last updated: 21 May 2026

1. Our Commitment to Data Protection

[ClassEngine Operating Entity], trading as ClassEngine.eu, is fully committed to compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and all applicable data protection legislation across the jurisdictions in which we operate.

Data protection is not an afterthought at ClassEngine.eu — it is a foundational principle of our platform. Given the sensitive nature of the data we handle (personal data of consumers affected by corporate and regulatory breaches), we hold ourselves to the highest standards of data stewardship.

2. Data Protection Principles

We adhere to the data protection principles set out in Article 5 of the GDPR:

  • Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner. We provide clear information about how and why we process your data.
  • Purpose limitation: We collect personal data for specified, explicit, and legitimate purposes and do not process it in a manner incompatible with those purposes.
  • Data minimisation: We collect only the personal data that is necessary for the purposes for which it is processed. We do not collect excessive or unnecessary data.
  • Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date. We provide mechanisms for data subjects to correct inaccurate data.
  • Storage limitation: We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
  • Integrity and confidentiality: We implement appropriate technical and organisational measures to protect personal data against unauthorised processing, accidental loss, destruction, or damage.
  • Accountability: We are responsible for, and able to demonstrate, compliance with all of the above principles.

3. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 of the GDPR for processing your personal data:

3.1 Consent (Article 6(1)(a))

We obtain your explicit consent for:

  • Sending marketing communications and case alert emails
  • Sharing your personal data with partner law firms for the purpose of collective redress
  • Setting non-essential cookies on your device

Consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time by contacting us at privacy@classengine.eu or by using the unsubscribe link in any marketing communication. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3.2 Performance of a contract (Article 6(1)(b))

When you register on the Platform and request to be connected with a partner law firm, processing of your personal data is necessary for the performance of our service — matching affected consumers with appropriate legal representation.

3.3 Legitimate interests (Article 6(1)(f))

We process certain personal data on the basis of our legitimate interests, including:

  • Operating, maintaining, and improving the Platform
  • Ensuring Platform security and preventing fraud
  • Generating anonymised, aggregated analytics
  • Communicating with registered users about their accounts

We have conducted legitimate interest assessments for each of these purposes and have determined that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests under Article 21 of the GDPR.

3.4 Legal obligation (Article 6(1)(c))

We may process personal data where necessary to comply with a legal obligation, such as tax reporting requirements or regulatory requests.

4. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who oversees our compliance with the GDPR and acts as the point of contact for data subjects and supervisory authorities.

Data Protection Officer
[ClassEngine Operating Entity]
Email: privacy@classengine.eu

The DPO is responsible for:

  • Monitoring compliance with the GDPR and internal data protection policies
  • Advising on Data Protection Impact Assessments (DPIAs)
  • Cooperating with the supervisory authority
  • Handling data subject requests and complaints

5. Your Rights as a Data Subject

Under the GDPR, you have the following rights. These rights are not absolute and may be subject to certain conditions and exceptions as provided by law.

  • Right of access (Article 15): You may request a copy of the personal data we hold about you, along with information about how it is processed.
  • Right to rectification (Article 16): You may request correction of inaccurate personal data or completion of incomplete data.
  • Right to erasure (Article 17): You may request deletion of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful.
  • Right to restriction of processing (Article 18): You may request that we restrict processing in certain circumstances, such as when you contest the accuracy of the data.
  • Right to data portability (Article 20): You may request to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes. For direct marketing, we will always respect your objection.
  • Rights related to automated decision-making (Article 22): We do not engage in automated decision-making that produces legal effects. If this changes, we will ensure appropriate safeguards are in place.
  • Right to withdraw consent (Article 7(3)): Where processing is based on consent, you may withdraw it at any time.

5.1 How to exercise your rights

To exercise any of the above rights, please contact our Data Protection Officer at privacy@classengine.eu. We will:

  • Verify your identity before processing any request
  • Respond within 30 days of receiving your request
  • Inform you if we need to extend the response period (by up to a further two months for complex requests)
  • Provide information free of charge (unless requests are manifestly unfounded or excessive)

5.2 Right to lodge a complaint

If you believe we have not handled your personal data properly or have not responded adequately to your request, you have the right to lodge a complaint with a supervisory authority. The relevant authorities for our operating jurisdictions are:

  • Ireland: Data Protection Commission (DPC) — www.dataprotection.ie
  • United Kingdom:Information Commissioner’s Office (ICO) — ico.org.uk
  • Portugal:Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt

6. Data Protection by Design and by Default

In accordance with Article 25 of the GDPR, we implement data protection by design and by default across the Platform:

  • We collect only the minimum personal data necessary for each purpose (data minimisation)
  • Privacy-protective settings are the default (e.g. optional fields are not pre-selected)
  • We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities
  • We implement appropriate security measures at every layer of the Platform

7. Data Processing Agreements

Where we engage data processors to process personal data on our behalf, we ensure that appropriate Data Processing Agreements (DPAs) are in place in accordance with Article 28 of the GDPR. Our key processors include:

  • Supabase: Database hosting (EU-hosted infrastructure). DPA in place covering data security, breach notification, and sub-processor management.
  • Vercel: Website hosting and content delivery. DPA in place covering data handling and international transfers.

We require all processors to implement appropriate technical and organisational measures and to process personal data only on our documented instructions.

8. Data Breach Notification

We have procedures in place to detect, report, and investigate personal data breaches in accordance with Articles 33 and 34 of the GDPR:

  • We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of natural persons
  • We will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms
  • We maintain a record of all personal data breaches, including the facts, effects, and remedial actions taken

9. International Data Transfers

We store personal data primarily within the European Economic Area (EEA). Where transfers outside the EEA are necessary, we ensure appropriate safeguards under Chapter V of the GDPR, including:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions by the European Commission
  • Transfer Impact Assessments where required

10. Record of Processing Activities

We maintain a Record of Processing Activities (ROPA) in accordance with Article 30 of the GDPR, documenting:

  • The purposes of processing
  • Categories of data subjects and personal data
  • Categories of recipients
  • International transfers and safeguards
  • Retention periods
  • Technical and organisational security measures

11. Staff Training

All personnel with access to personal data receive regular training on data protection obligations, including GDPR requirements, data breach procedures, and the rights of data subjects.

12. Contact Our DPO

For any questions, concerns, or requests related to data protection and the GDPR, please contact our Data Protection Officer:

Data Protection Officer
[ClassEngine Operating Entity]
Email: privacy@classengine.eu