GDPR
Statement

VYRON is the controller for member and lead data: it decides what is collected and why. The services listed in the Privacy Policy are processors acting on instruction.

The controller is [legal entity — not yet registered]. A statement of GDPR compliance by an entity that does not exist is not worth much, which is why this page is a draft.

• Contract — providing the membership you paid for.
• Consent — the reservation list and any marketing email. Withdraw it by writing; one line is enough.
• Legitimate interests — running the community safely, moderation, answering support, keeping the service secure. Balanced against your rights, and you can object.
• Legal obligation — accounting and tax records once payments exist.

Nothing relies on "legitimate interests" where consent is really what is meant. If that distinction ever gets blurred here, it is a drafting error and should be reported.

Two decisions were made in the database rather than in a policy, which is the only place they actually bind:

• Your trading journal is readable by you alone. Not by other members, not by the founders. Enforced by row-level security, so it survives anyone with admin access.
• Direct messages are closed the same way, readable only by the two people in the conversation.

A promise in a document can be broken by a mistake in an interface. A rule in the database cannot.

• Access — a copy of everything held about you, including internal support notes.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, subject to the retention rules in the Privacy Policy.
• Portability — a machine-readable export.
• Restriction and objection — including to anything based on legitimate interests.
• Withdrawal of consent — at any time, without needing a reason.

Write to Vyronsociety@gmail.com. No form, no fee, and a reply within one month. If the answer is unsatisfactory you may complain to a supervisory authority; which authority depends on where VYRON is established, and that is [legal entity — not yet registered].

This draft exists so the gaps are visible to whoever reviews it:

• The legal entity is not registered, so there is no controller to name.
• The Supabase region must be confirmed as EU before transfer claims can be made.
• Processor agreements are not yet in place with any provider.
• Soft-deleted community posts versus the right to erasure needs a ruling.
• Whether a DPO is required has not been assessed.
• The lead records include free-text notes written about people who never signed up. That table needs a retention limit and a rule about what may be written in it.

None of these stop the site collecting reservation emails today, and all of them must be closed before paid membership opens.

A personal data breach would be assessed immediately, reported to the supervisory authority within 72 hours where the law requires it, and disclosed to affected people where the risk to them is high. There is no procedure document yet; writing one is part of the pending work.