Reflex Builders LLC dba Reflex Builders is committed to protecting the personal data and privacy rights of all individuals, including those in the European Economic Area (EEA). This statement outlines our compliance with the General Data Protection Regulation (GDPR) and your rights regarding your personal data.
Lawful Basis and Transparency
We have conducted a comprehensive information audit to determine what personal data we process and who has access to it within our organization. Our data processing activities are based on the following lawful grounds:
- Contractual necessity for construction services and project management
- Consent for marketing communications and non-essential cookies
- Legal obligation for tax records, building permits, and regulatory compliance
- Legitimate interest for business operations and service improvement
We maintain detailed records of our processing activities, including the purposes of processing, types of data collected, access permissions, third-party processors, security measures, and data retention schedules. This information is available in our Privacy Policy and can be provided upon request.
Data Security
Reflex Builders implements data protection by design and by default, incorporating privacy considerations into all our business processes:
- Technical measures: We encrypt personal data during transmission and storage, use pseudonymization where possible, and implement access controls
- Organizational measures: We limit data collection to what is necessary for our services, regularly delete data we no longer need, and maintain internal security policies
- Staff training: All team members receive data protection awareness training and sign confidentiality agreements
- Impact assessments: We conduct data protection impact assessments for high-risk processing activities
- Breach notification: We have procedures in place to notify authorities and affected individuals within 72 hours of discovering a data breach
Accountability and Governance
We have designated a Data Protection Coordinator responsible for ensuring GDPR compliance across our organization. This person is empowered to:
- Evaluate and implement data protection policies
- Monitor compliance with GDPR requirements
- Serve as the point of contact for data protection inquiries
- Conduct regular compliance assessments
All third-party service providers who process personal data on our behalf operate under signed data processing agreements that ensure GDPR compliance. As a US-based company serving EU individuals, we have appointed a representative within the EU to handle data protection matters.
Your Privacy Rights
Under GDPR, you have the following rights regarding your personal data:
Right of Access: You can request information about what personal data we hold about you and how we use it. We will provide the first copy free of charge.
Right to Rectification: You can request correction of inaccurate or incomplete personal data.
Right to Erasure (Right to be Forgotten): You can request deletion of your personal data under certain circumstances.
Right to Restrict Processing: You can request that we limit how we process your data in certain situations.
Right to Data Portability: You can request a copy of your personal data in a machine-readable format for transfer to another service provider.
Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making: If we make decisions about you based on automated processes, you have the right to human intervention and explanation.
How to Exercise Your Rights
To exercise your rights, contact us. We will respond to your request within one month and verify your identity before processing any requests. In complex cases, we may extend this period by up to two additional months.
Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected:
- Contact inquiries: 24 months
- Client project data: 7 years (for warranty and legal compliance)
- Financial records: 7 years (for tax and regulatory requirements)
- Marketing communications: Until you withdraw consent
International Data Transfers
When we transfer personal data outside the EEA, we ensure adequate protection through:
- Standard Contractual Clauses approved by the European Commission
- Data processing agreements with appropriate safeguards
- Assessment of the recipient country’s data protection laws
Complaints
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with:
- Your local Data Protection Authority (DPA) in the EEA
- The Information Commissioner’s Office (ICO) if you are in the UK
Updates to This Statement
We may update this GDPR compliance statement from time to time. Material changes will be communicated to affected individuals and posted on our website with an updated effective date.
Contact Information
For any questions about our GDPR compliance or to exercise your privacy rights:
This statement does not constitute legal advice. For specific legal questions about GDPR compliance, please consult with a qualified attorney.
