GDPR & Data Subject Rights

1. Data Controller

The data controller for personal data processed through the BatchCortex website and platform is:

2. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: Waitlist signup data is processed based on your explicit consent when submitting the form
• Contract performance: Application data is processed as necessary to deliver the BatchCortex service under your organization's customer agreement
• Legitimate interest: We may process limited data for product improvement and security purposes, balanced against your privacy rights

3. Data Subject Access Request (DSAR)

You have the right to request access to all personal data we hold about you. To submit a DSAR:

We will respond to your request within 30 days of receipt. If we need additional time (up to 60 additional days for complex requests), we will notify you within the initial 30-day period.

If an extension beyond 30 days is required due to request complexity, we will notify you within the initial 30-day period, explaining the reason for the delay. Extensions will not exceed an additional 60 days (90 days total), in accordance with GDPR Article 12(3).

4. Your Rights Under GDPR

• Right of access — request a copy of your personal data
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (“right to be forgotten”)
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to restrict processing — request that we limit how we use your data

5. Supervisory Authority

You have the right to lodge a complaint with the Swedish data protection authority: