Corvus Network Inc.

GDPR Notice

Download PDF

1. Data Controller Information

Corvus Network Inc. acts as the data controller for personal data collected through our fiduciary intelligence platform:

• Legal Entity: Corvus Network Inc.
• Jurisdiction: Wyoming, United States of America
• Data Protection Officer: [email protected]
• EU Representative: Available upon request for EU-based clients

2. Lawful Basis for Processing

We process personal data of EU/EEA residents under the following lawful bases:

2.1 Contractual Necessity (Article 6(1)(b) GDPR)

• Delivering fiduciary intelligence services and consultation
• Processing payments and maintaining service agreements
• Providing access to the secure client portal
• Communicating about service delivery and updates

2.2 Legitimate Interests (Article 6(1)(f) GDPR)

• Platform security and fraud prevention
• Internal analytics for service improvement
• Direct marketing to existing clients (with opt-out option)
• Legal claims and dispute resolution

2.3 Legal Obligation (Article 6(1)(c) GDPR)

• Compliance with financial regulations and anti-money laundering laws
• Tax reporting and record-keeping requirements
• Response to lawful requests from authorities

2.4 Consent (Article 6(1)(a) GDPR)

• Non-essential cookies and tracking (see our Cookie Notice)
• Marketing communications to non-clients
• Any special category data processing (with explicit consent)

3. Your GDPR Rights

As an EU/EEA resident, you have the following rights under GDPR:

3.1 Right to Access (Article 15)

You have the right to obtain confirmation that we process your personal data and to receive a copy of that data. We will provide this information free of charge within one month of your request.

3.2 Right to Rectification (Article 16)

You can request correction of inaccurate personal data and completion of incomplete data. We will respond within one month and notify third parties if applicable.

3.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You may request deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent and there is no other lawful basis for processing
• You object to processing based on legitimate interests and there are no overriding grounds
• The data was unlawfully processed
• Deletion is required by legal obligation

Limitations: We may retain data where necessary for legal compliance, establishment of legal claims, or performance of a contract.

3.4 Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data in certain circumstances, such as when you contest accuracy or object to processing.

3.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and to transmit that data to another controller.

3.6 Right to Object (Article 21)

You may object to processing based on legitimate interests or direct marketing. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

3.7 Rights Related to Automated Decision-Making (Article 22)

We do not currently engage in automated decision-making or profiling that produces legal effects. If this changes, you will be notified and provided with rights to contest such decisions.

3.8 Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

4. How to Exercise Your Rights

To exercise any of your GDPR rights:

1. Submit a written request to [email protected]
2. Include your full name, email address, and specific right you wish to exercise
3. Provide identification to verify your identity (we may request additional verification for security)
4. Specify the scope of your request (all data, specific categories, etc.)

We will respond within one month. For complex requests, we may extend this period by two additional months, providing notice and explanation.

5. International Data Transfers

Your personal data may be transferred from the EU/EEA to the United States and other jurisdictions. We ensure appropriate safeguards for such transfers:

• Standard Contractual Clauses: We use EU Commission-approved Standard Contractual Clauses (SCCs) for transfers to third countries
• Adequacy Decisions: We rely on EU Commission adequacy decisions where applicable
• Processor Agreements: Third-party processors (Stripe, Google Cloud) maintain GDPR-compliant data processing agreements
• Supplementary Measures: Additional technical and organizational measures including encryption, access controls, and data minimization

6. Data Retention Under GDPR

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law:

• Active Clients: Duration of relationship plus 7 years (financial records requirement)
• Prospective Clients: 3 years from last contact (unless consent withdrawn)
• Consultation Requests: 5 years from submission
• Marketing Data: Until consent withdrawn or 2 years of inactivity
• Legal Claims: Duration of applicable limitation periods

7. Security Measures

We implement technical and organizational measures appropriate to the risk, including:

• Pseudonymization and encryption of personal data
• Ongoing confidentiality, integrity, availability, and resilience of systems
• Ability to restore availability and access to data in a timely manner
• Regular testing and evaluation of security effectiveness
• Staff training on data protection principles
• Data breach notification procedures

8. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware
• You will be notified without undue delay if the breach is likely to result in high risk to you
• Notifications will include nature of breach, consequences, and measures taken

9. Children's Data

Our services are not directed to individuals under 18. We do not knowingly process data of children. If you believe we have inadvertently collected data from a minor, contact us immediately for deletion.

10. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your:

• Habitual residence
• Place of work
• Place of alleged infringement

Find your local Data Protection Authority: edpb.europa.eu/about-edpb/about-edpb/members_en

11. Updates to This Notice

We may update this GDPR Notice to reflect changes in law or our practices. Material changes will be communicated via:

• Email to affected EU/EEA clients
• Prominent platform notice for 30 days
• Updated effective date on this page

12. Contact Information

For GDPR-related inquiries, rights requests, or complaints:

• Data Protection Officer: [email protected]
• GDPR Requests: [email protected]
• General Inquiries: [email protected]

Subject Line: "GDPR Rights Request" or "GDPR Inquiry" for faster processing.

Please also review our related policies: Privacy Policy, Terms & Conditions, Cookie Notice, and Refund Policy.