GDPR Compliance Statement

1. Our Commitment to Data Privacy

At EliteHacker, we understand that data privacy is a fundamental human right. As a global provider of elite cybersecurity services, we are deeply committed to complying with the General Data Protection Regulation (GDPR) (EU) 2016/679. We have designed our internal systems, processes, and offensive security methodologies to ensure the highest standards of data protection for our clients and their end-users.

2. Core Processing Principles

In accordance with Article 5 of the GDPR, EliteHacker strictly adheres to the following data processing principles:

• Lawfulness, Fairness, and Transparency: We only process personal data when we have a legal basis to do so, and we are entirely transparent about our processing activities.
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner that is incompatible with those purposes.
• Data Minimization: We only collect personal data that is adequate, relevant, and limited to what is strictly necessary for the engagement (e.g., scoping a penetration test).
• Accuracy: We take every reasonable step to ensure that personal data is accurate and, where necessary, kept up to date.
• Storage Limitation: Data is kept in a form which permits identification of data subjects for no longer than is necessary. Following the conclusion of a cybersecurity audit, sensitive client data is securely destroyed as per our Data Retention Policy.
• Integrity and Confidentiality: Data is processed in a manner that ensures appropriate security, protecting against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

3. Data Controller vs. Data Processor

EliteHacker as a Data Controller: We act as a Data Controller when we collect information directly from you (e.g., when you visit our website, sign up for a newsletter, or enter into a contract with us for services).

EliteHacker as a Data Processor: During the execution of our services—such as penetration testing, Red Teaming, or Incident Response—we act as a Data Processor. Any data (including PII) belonging to our clients that we may inadvertently access during an authorized test is handled strictly under the instructions of the Client (the Data Controller). We immediately report, secure, and subsequently purge this data upon the conclusion of the engagement.

4. Your Rights as a Data Subject

Under the GDPR, individuals residing in the European Economic Area (EEA) possess specific rights regarding their personal data. EliteHacker fully supports these rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
• Right to Restrict Processing: You can ask us to suspend the processing of your data under certain scenarios.
• Right to Data Portability: You can request the transfer of your data to you or a third party in a structured, machine-readable format.
• Right to Object: You can object to the processing of your personal data when we are relying on a legitimate interest.

To exercise any of these rights, please contact our Data Protection Officer using the details provided below.

5. International Data Transfers

As EliteHacker operates globally, it may be necessary to transfer your data outside of the EEA. Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards: transferring data to countries deemed to provide an adequate level of protection by the European Commission, or using specific contracts approved by the European Commission (Standard Contractual Clauses).

6. Security Measures

Given the nature of our business, EliteHacker employs state-of-the-art security measures to protect data. This includes military-grade encryption for data at rest and in transit, strict Role-Based Access Control (RBAC), multi-factor authentication (MFA) across all systems, and continuous internal vulnerability scanning of our own infrastructure.

7. Contact our Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee compliance with this GDPR Statement. If you have any questions, concerns, or requests regarding your data, please contact our DPO: