This statement sets out how Super Save Protocol Ltd meets its obligations under Regulation (EU) 2016/679 (EU GDPR), the UK GDPR and the Data Protection Act 2018, and how it applies those standards alongside India's Digital Personal Data Protection Act, 2023.
It supplements the Privacy Policy, which contains the detail of what we collect and why.
01 Our position in the data chain
Super Save Protocol acts in two capacities, and the difference determines who you contact:
| Capacity | Applies to | Who is accountable |
|---|---|---|
| Controller | Website visitors, enquiries, marketing, individual user accounts, our own security and audit logs | Super Save Protocol Ltd |
| Processor | Registry records submitted by a Member, including any personal data within them | The Member institution as controller; we process on its documented instructions |
Where we act as processor, the Data Processing Agreement forms part of the membership agreement and sets out Article 28 terms in full.
02 The principles, and how we apply them
| Article 5 principle | How we meet it |
|---|---|
| Lawfulness, fairness, transparency | Every purpose has a documented lawful basis, published in the Privacy Policy in a table rather than buried in prose. |
| Purpose limitation | Registry data is used for duplicate and fraud detection, compliance and audit. It is not repurposed for marketing, credit scoring or profiling. |
| Data minimisation | We collect the identifiers needed to detect a collision and nothing more. We deliberately do not collect pricing, margin or credit assessments. |
| Accuracy | Members warrant the accuracy of what they submit. Correction requests are routed to the registering Member and tracked to closure. |
| Storage limitation | Retention periods are published per category in the Data Retention Policy, with a documented justification for the long periods on audit and registry records. |
| Integrity and confidentiality | Encryption in transit and at rest, role-based access with organisation scoping, two-factor authentication, append-only audit logging. |
| Accountability | Records of processing, data protection impact assessments, vendor due diligence, breach procedures and staff training, all reviewed at least annually. |
03 Data subject rights
You may request access, rectification, erasure, restriction, portability, or object to processing, and you may withdraw consent where consent is the basis. The full description is in the Privacy Policy.
How to make a request
- Email privacy@supersaveprotocol.com with the right you wish to exercise and enough detail to identify your data.
- We acknowledge within 5 business days and may ask for proof of identity.
- We respond within one month, extendable by two further months for complex requests, and we tell you if we extend and why.
- If we cannot act, we explain why and how to complain.
Where a Member is the controller
If your data reached the registry through a bank, factor, customs authority or cheque casher, that institution is the controller. We will forward your request to it within 5 business days, tell you we have done so, and assist it in responding as Article 28(3)(e) requires.
Limits we will assert
We will normally refuse erasure of audit log entries and of registry records within their retention period, relying on Article 17(3)(b) and 17(3)(e) — compliance with a legal obligation, and the establishment, exercise or defence of legal claims. A registry that can be edited by the parties it records is not an anti-fraud control. We tell you when we rely on this and how to challenge it.
04 Automated decision-making and profiling
The registry generates match and fraud scores automatically. We take the position that these are not decisions within Article 22, because:
- a score is returned to a human officer at a Member institution, who decides;
- every score is accompanied by the specific signals that produced it, so it can be examined and contested;
- Members are contractually required to apply human judgement and not to auto-decline on score alone.
Members are responsible for ensuring their own use of Output does not become solely automated decision-making without an Article 22 basis and appropriate safeguards. If you believe a decision affecting you was made solely by automated means, contact dpo@supersaveprotocol.com and we will investigate with the Member concerned.
05 International transfers
Transfers outside the UK or EEA rely on an adequacy decision, the EU Standard Contractual Clauses with the UK International Data Transfer Addendum where applicable, or another lawful mechanism. We complete a transfer risk assessment before relying on contractual safeguards, and apply supplementary measures where it identifies a need. Copies are available on request.
06 Personal data breaches
- We maintain a documented incident response procedure with defined severity levels and named owners.
- Where we are controller and a breach is likely to result in a risk to rights and freedoms, we notify the lead supervisory authority within 72 hours of becoming aware.
- Where the risk is high, we notify affected individuals without undue delay.
- Where we are processor, we notify the Member controller without undue delay so it can meet its own deadline.
- All breaches, notifiable or not, are recorded in our internal breach register.
07 Governance and accountability
- A Data Protection Officer is appointed and reachable at dpo@supersaveprotocol.com.
- Records of processing activities are maintained under Article 30 for both controller and processor roles.
- Data protection impact assessments are completed before launching processing likely to result in high risk, including each new registry module.
- Sub-processors are subject to due diligence and written Article 28 terms, and are listed publicly at Sub-processors.
- Staff receive data protection training on joining and annually thereafter.
- Privacy by design and by default is applied at the point of feature design, not retrofitted.
Questions about this document?
Write to legal@supersaveprotocol.com, or to Super Save Protocol Ltd, 207 Regent Street, London, W1B 3HH, United Kingdom. You can also see all our legal documents.