> For the complete documentation index, see [llms.txt](https://support.happydemics.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.happydemics.com/security-and-confidentiality/confidentiality/how-does-happydemics-comply-with-the-gdpr.md).
# How does Happydemics comply with the GDPR?
At Happydemics, data protection is a core part of how we operate. Our compliance program covers the EU's General Data Protection Regulation (GDPR), the data protection laws applicable in the other countries where we provide our services, and the advertising industry standards that apply to our activity (such as the IAB Europe Transparency & Consent Framework, where Happydemics is a registered vendor – Global vendor 550), so that we meet our obligations and stay transparent with our clients about how we use data.
Here's an overview of how Happydemics complies with the GDPR, as part of that broader compliance program:
### What is GDPR?
The GDPR is a comprehensive personal data protection law that became applicable on May 25, 2018. It replaced existing European legislation to strengthen the protection of "personal data" and the rights of individuals. It is a single set of rules regulating how personal data of individuals in the EU is processed and controlled.
### Does this impact you?
Yes, most likely. If you hold or process someone's data in the EU, the GDPR will apply to you, whether you're based in the EU or not.
### Data Processing Agreement (DPA)
Strong data protection commitments are a key part of the GDPR requirements. Our Data Processing Agreement (DPA) sets out our privacy commitments and the conditions under which Happydemics and its clients meet their obligations under the GDPR and other applicable data protection laws, including appropriate safeguards for any international transfer of personal data. Our DPA is available to clients on request.
### Data Protection Officer (DPO)
We have a Data Protection Officer and a team to oversee and advise our data management. You can contact our Data Protection Officer using the messaging system or by sending an e-mail to .
### Supplier coordination
We regularly review our suppliers and subprocessors, assess their compliance with the GDPR and other applicable data protection requirements, and have signed data processing agreements with all of them. Our current list of subprocessors is available to clients on request.
### Security measures
Security is a priority for us. We regularly perform external and internal audits and penetration tests.
Happydemics is SOC 2 Type II compliant. We maintain a solid security framework built on industry best practices, including appropriate safeguards for any international transfer of personal data.
We have reviewed our internal access design to ensure that the right people have access to the right set of client data. We continue to help our clients and prospects achieve compliance. Here are a few measures you can implement:
* Understand the requirements of the GDPR, other applicable local data protection laws, and relevant ad tech industry standards (such as the IAB Europe Transparency & Consent Framework), and how they impact your business;
* Map out all the locations where you process data and do a gap analysis;
* See how you can leverage Happydemics to help you achieve compliance. Our SOC 2 report, audit reports, penetration test results and security documents are available to customers on request;
* Review your product roadmap, think privacy when planning;
* Talk to your lawyer about what your company needs to do;
* Stay up-to-date with the guidelines issued by the European Data Protection Board (EDPB) and other relevant data protection authorities.
👋 If you don't find your answer, feel free to reach out to or for further consideration !