Data Privacy & GDPR Policy

This Privacy Policy describes how Smartpath and Associates ("we", "us", or "our") collects, uses, and discloses your personal data when you use the ModuLynx platform.

As a provider of an enterprise ERP and management suite, we act as a Data Processor for the data you input into our modules (Project, Procurement, Fleet, etc.) and a Data Controller for your account information and usage analytics.

• Identity Data: Full name, professional email address, job title, and organization affiliation.
• Operational Data: All data submitted through the procurement, project, and fleet management modules.
• Technical Data: IP addresses, browser types, session durations, and access logs (essential for security audit trails).
• Payment Data: We process billing information through secure, PCI-DSS compliant third-party processors.

We process your information under the following legal bases as defined by the General Data Protection Regulation (GDPR):

- Performance of a Contract: To provide the services agreed upon in our Master Service Agreement.
- Legal Obligation: To comply with financial reporting, anti-money laundering, and tax laws.
- Legitimate Interests: For platform security, audit logging, and improving organization-wide efficiencies.

ModuLynx implements industry-leading security measures, including AES-256 encryption at rest andTLS 1.3 encryption in transit.

In compliance with ISO 27001 standards, we maintain strict logical separation between organizational tenants, ensuring that data from one organization is never accessible by another (Anti-IDOR protection).

Under GDPR and other international data protection laws, you have the right to:

- Access & Portability: Obtain a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request the deletion of your personal data ("Right to be Forgotten").
- Restriction: Object to specific processing activities.

Data may be transferred to and processed in countries outside your own. We ensure all such transfers are protected by Standard Contractual Clauses (SCCs) and only partner with providers that maintain equivalent levels of data protection (e.g., SOC2, ISO 27001).