GDPR Compliance

MindRay GDPR Compliance

This page explains how Mindray Technologies Limited supports compliance with the General Data Protection Regulation (GDPR) when processing personal data in connection with MindRay, including data used for partnership inquiries, service operations, support, digital content delivery, subscriber engagement, analytics, and related services.

Last updated: April 27, 2026

Roles & Responsibilities

Depending on how you use MindRay, Mindray Technologies Limited may act as a data controller or a data processor under GDPR.

As a controller, we determine how and why certain personal data is processed, such as for account administration, security, legal compliance, and service communications.
As a processor, we process data on your behalf to provide platform functionality according to your instructions and applicable agreements.

Lawful Bases for Processing

Contract: To provide, operate, and support the service.
Legitimate Interests: To improve, secure, monitor, and maintain the platform.
Consent: Where required, including for certain communications or optional processing activities.
Legal Obligation: To comply with applicable laws, regulations, and lawful requests.

Data Subject Rights

You may have the following rights under GDPR:

Right of access to your personal data.
Right to rectification of inaccurate or incomplete data.
Right to erasure ("right to be forgotten").
Right to restrict processing.
Right to data portability.
Right to object to certain processing activities.

To exercise your rights, contact us at [email protected].

International Data Transfers

Personal data may be processed or transferred outside the European Economic Area (EEA). Where this occurs, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent lawful transfer mechanisms.

Security Measures

We implement technical and organizational measures designed to protect personal data, including safeguards such as encryption, access controls, monitoring, and operational protections intended to reduce unauthorized access, disclosure, alteration, or loss.

Data Breach Notification

If a personal data breach occurs, we will assess the incident and notify relevant supervisory authorities and affected individuals where required by GDPR and other applicable laws.

Data Processing Agreements

Where required, we enter into Data Processing Agreements (DPAs) with customers, vendors, and service providers to support GDPR-compliant handling of personal data.

Retention & Deletion

We retain personal data only for as long as needed to provide the service, meet legal obligations, resolve disputes, enforce agreements, and maintain legitimate business records. When retention is no longer required, we delete or anonymize data in accordance with our internal practices and applicable law.

Contact

For GDPR-related questions, data subject requests, or privacy inquiries, contact us at [email protected].

Governing law reference: Federal Republic of Nigeria