GDPR Compliance

Edplay is committed to GDPR compliance

Overview

Edplay has implemented processes and procedures to support our Data Controller and Data Processor obligations under the European Union’s (EU) General Data Protection Regulation (GDPR).

To determine our readiness for GDPR, Edplay conducted a risk-based gap analysis of our current capabilities under the oversight of our Data Protection Officer, Martin de Bruin. Our gap analysis, Cybersecurity Policy, Acceptable Use Policy and Incident Response Policy are available on request.

Important to note: GDPR does not have an accredited certification method, which means there is no GDPR-approved way to demonstrate compliance. If you have questions regarding our approach to compliance, please reach out to dpo@edplay.ai and our Data Protection Officer will be glad to answer any questions you may have.

Security

Edplay has strong data protection controls including encryption of data in transit and at rest, in order to safeguard Data Subjects’ data from unintended disclosure or misuse. Edplay follows industry-standard information security practices and tests its products to proactively remedy bugs and vulnerabilities.

Edplay maintains incident response and notification processes which are reviewed and tested annually. Edplay has procedures in place to support data recovery and data integrity, so that customer data is not lost or inadvertently corrupted. Edplay provides assurances that the customer retains control of their data.

Edplay’s key data sub-processors (for example, DigitalOcean and others) maintain rigorous security standards — including, where applicable, ISO/IEC 27001, SOC 1 Type II, SOC 2 Type II, PCI-DSS certifications and certification/self-certification under the EU–U.S. and Swiss–U.S. Data Privacy Framework — and undergo periodic vendor reviews.

Contractual Agreements

Edplay provides Data Processing Agreements to any customer who may need them. Included in the Data Processing Agreement are standard contractual clauses (and, where applicable, reliance on the Data Privacy Framework) for the transfer of personal data to third countries. These mechanisms allow customers to transfer data to countries outside the European Economic Area (EEA) and United Kingdom in order to use the Edplay platform. Edplay also maintains Data Processing Agreements with its sub-processors where required by law.

Recommendations for Edplay Customers

We believe security and privacy are a shared responsibility between vendor and customer. Edplay is committed to helping you meet your GDPR requirements. It is important to understand your obligations under the GDPR regardless of where your organization resides.

1. Read and Understand the Regulation

Read through and understand the regulation. Multiple languages and formats are available at https://gdpr.eu.

2. Perform a Gap Analysis

Perform a gap or impact analysis to determine whether any controls or processes need to be put in place to adhere to the regulation, and implement those changes if necessary.

3. Review Personal Information

Review the personal information shared with Edplay, including any integrations, and ensure you are not sharing or storing unneeded or sensitive data (e.g. SSN, PPS, National Insurance, driver’s licence, date of birth, address, credit card number, passport number). Determine whether you require consent from Data Subjects and update your consent collection, forms or APIs if necessary.

4. Review Processors

Review any processors, including Edplay, which may store or process personal information. Ensure they have proper processes and controls in place and establish Data Processing Agreements where necessary. Update your privacy policy to reflect your use of Edplay as a data processor.

5. Email Tracking Consent

Ensure you have the proper consent to track email opens. If not, we encourage you to turn those features off, and to include unsubscribe links or notices where required by law.

6. Right to be Forgotten

If you receive a Right to be Forgotten request from a Data Subject, delete the user within Edplay. The information is removed from our active systems and is deleted from backups in line with our standard deletion and backup cycles.

Complete Data Removal

If you or your company wish to have your data removed from our systems, please email support@edplay.ai. Data is deleted from active systems and thereafter from backups in line with our deletion and backup cycles.

This GDPR compliance documentation is regularly reviewed and updated to reflect changes in legislation, guidance, and best practices. Version 2.0 (last updated 13 July 2026).