GDPR Compliance Statement

What is GDPR and Who Does It Apply To?

GDPR Scope and Definitions

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018, governing how organizations collect, store, process, and protect personal data of individuals within the European Union (EU), European Economic Area (EEA), and United Kingdom.

GDPR applies to abaonline.us because we offer information services to visitors located in the EU/EEA/UK. Even though we are based in the United States, GDPR requires us to protect the personal data of European visitors and respect their enhanced privacy rights.

As the data controller, abaonline.us is responsible for ensuring that all personal data collected from EU/EEA/UK visitors is processed lawfully, transparently, and in accordance with GDPR principles.

Legal Basis for Processing Your Data

Under GDPR Article 6, we must have a lawful basis for processing your personal data. We rely on the following legal bases depending on the type of data and purpose:

Legitimate Interest (Article 6(1)(f))

We process certain data based on our legitimate interest in operating an informational website about Latin dating services. This includes:

• Website analytics: Understanding how visitors use our site to improve content quality and user experience
• Security and fraud prevention: Protecting our website from malicious activity, spam, and abuse
• Technical operations: Maintaining website functionality, performance optimization, and error monitoring

We have carefully balanced our legitimate interests against your privacy rights and have implemented appropriate safeguards. You have the right to object to processing based on legitimate interest at any time.

Consent (Article 6(1)(a))

For certain processing activities that are not strictly necessary for website operation, we obtain your explicit consent:

• Optional cookies: Non-essential cookies for enhanced analytics require your consent through our cookie banner
• Marketing communications: If you choose to subscribe to updates or newsletters (we do not currently offer this service)
• Contact forms: When you voluntarily provide information through contact forms, your submission constitutes consent

Your consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Legal Obligation (Article 6(1)(c))

We may process data when necessary to comply with legal obligations, such as responding to valid law enforcement requests or fulfilling tax and accounting requirements under applicable US and international laws.

Data Minimization and Retention

GDPR Article 5 requires that we collect only the minimum amount of personal data necessary for specified purposes and retain it no longer than needed. We take this principle seriously.

What Data We Collect

As an informational website, we collect minimal personal data:

• Automatically collected technical data: IP address (anonymized after 14 days), browser type, device information, referring URL, pages visited, time spent on pages
• Cookies: Essential session cookies for site functionality, optional analytics cookies only with your consent
• Voluntarily provided data: Information you choose to submit through contact forms (name, email address, message content)

We do NOT collect:

• Social Security numbers, government ID numbers, or financial information
• Sensitive personal data such as health information, sexual orientation, or political opinions
• Data from children under 18 years of age
• Location data beyond general geographic region derived from IP address

Data Retention Periods

We retain personal data only as long as necessary for the purposes for which it was collected:

After the retention period expires, we securely delete or anonymize your personal data so it can no longer identify you. Anonymized data may be retained indefinitely for statistical purposes.

Automated Deletion

We have implemented automated processes to ensure data is deleted according to our retention schedule. You do not need to request deletion of data that is subject to automatic deletion, though you may exercise your right to erasure at any time.

Your Rights Under GDPR

GDPR grants EU/EEA/UK residents comprehensive rights regarding their personal data. We are committed to facilitating the exercise of these rights promptly and free of charge.

Right to Access (Article 15)

You have the right to obtain confirmation as to whether we are processing your personal data and, if so, to access that data along with information about how it is being used.

How to exercise: Send an access request to our contact email (see Contact section below). We will provide a copy of your personal data in a commonly used electronic format within 30 days.

Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed.

How to exercise: Contact us with details of the inaccuracy or incompleteness. We will correct or complete the data within 30 days and notify any third parties to whom the data was disclosed.

Right to Erasure / "Right to Be Forgotten" (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent on which processing is based (and there is no other legal basis)
• You object to processing based on legitimate interest and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Deletion is required to comply with a legal obligation

How to exercise: Submit a deletion request explaining your reason. We will delete your data within 30 days unless we have a legal obligation to retain it (e.g., financial records required by law).

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

How to exercise: Request a data export. We will provide your data in CSV or JSON format within 30 days.

Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interest or for direct marketing purposes.

How to exercise: Submit an objection request. For direct marketing, we will stop processing immediately. For legitimate interest processing, we will stop unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Restriction of Processing (Article 18)

You have the right to request temporary restriction of processing when:

• You contest the accuracy of data (restriction during verification)
• Processing is unlawful but you prefer restriction over erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing (restriction pending verification of overriding grounds)

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

How to exercise: Adjust your cookie preferences in your browser settings or contact us to withdraw consent for specific processing activities.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of alleged infringement if you believe we have violated GDPR.

While we encourage you to contact us first to resolve concerns, you may contact your national data protection authority at any time.

International Data Transfers

abaonline.us is operated from the United States. When you access our website from the EU/EEA/UK, your personal data is transferred to and processed in the United States, which the European Commission has not deemed to provide an adequate level of data protection equivalent to EU law.

Safeguards for Data Transfers

To protect your data during international transfers, we implement the following safeguards:

Technical and Organizational Measures

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 or higher
• Encryption at rest: Personal data stored on our servers is encrypted using industry-standard AES-256 encryption
• Access controls: Strict authentication and authorization protocols limit data access to authorized personnel only
• Data minimization: We transfer only the minimum data necessary for specified purposes

Contractual Safeguards

Where we engage third-party processors located outside the EU/EEA/UK, we ensure they:

• Enter into data processing agreements that include Standard Contractual Clauses (SCCs) approved by the European Commission
• Implement appropriate technical and organizational security measures
• Process data only on our documented instructions
• Notify us promptly of any data breaches

Third-Party Processors

We carefully vet all third-party service providers that may process EU/EEA/UK resident data:

• Web hosting: Our hosting provider maintains SOC 2 Type II compliance and has implemented EU-US data transfer mechanisms
• Analytics: We use analytics services with GDPR-compliant configurations, including IP anonymization and data processing agreements
• Content Delivery Network (CDN): Our CDN provider has data centers in the EU and complies with GDPR requirements

Your Consent to Transfer

By using our website from the EU/EEA/UK, you acknowledge and consent to the transfer of your personal data to the United States subject to the safeguards described above. If you do not consent to this transfer, please do not use our website.

Technical and Organizational Security Measures

GDPR Article 32 requires us to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. We take data security seriously and have implemented comprehensive safeguards.

Technical Security Measures

• Encryption: TLS 1.3 encryption for data in transit; AES-256 encryption for data at rest
• Firewall protection: Web application firewall (WAF) to detect and block malicious traffic
• Intrusion detection: Automated monitoring systems alert us to suspicious activity
• Secure authentication: Multi-factor authentication for administrative access to systems
• Regular backups: Encrypted daily backups stored in geographically separate locations
• Vulnerability scanning: Regular automated scans and manual penetration testing
• Patch management: Timely application of security updates to all systems and software
• DDoS protection: Distributed denial-of-service mitigation to ensure availability

Organizational Security Measures

• Access control policies: Role-based access ensures personnel can access only data necessary for their duties
• Staff training: Regular privacy and security training for all team members with data access
• Confidentiality agreements: All personnel sign confidentiality agreements
• Vendor management: Thorough due diligence and contractual security requirements for third-party processors
• Incident response plan: Documented procedures for detecting, responding to, and recovering from data breaches
• Privacy by design: Data protection considerations integrated into all new projects and features
• Regular audits: Internal and external security audits to identify and remediate vulnerabilities

Data Breach Notification

In accordance with GDPR Article 33 and 34, if we experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms
• Provide clear information about the nature of the breach, its likely consequences, and measures taken to address it
• Document all data breaches, including facts, effects, and remedial actions taken

Contact Us for Data Requests

We are committed to transparency and facilitating the exercise of your GDPR rights. If you have questions about how we process your data or wish to exercise any of your rights, please contact us.

Data Protection Contact

Email: [email protected]

Subject line: Please use "GDPR Data Request" for faster processing

Response time: We will acknowledge your request within 3 business days and provide a substantive response within 30 days (or explain why we need up to an additional 60 days for complex requests)

Information to Include in Your Request

To help us process your request efficiently and verify your identity, please include:

• Your full name and email address associated with your data
• Description of the specific right you wish to exercise (access, erasure, rectification, etc.)
• Any relevant details that help us locate your data (e.g., approximate dates of website visits, pages viewed)
• Proof of identity (we may request additional verification for security purposes)

No Fees for Most Requests

We do not charge a fee for most data subject requests. However, we may charge a reasonable administrative fee or refuse to act on a request if it is manifestly unfounded, excessive, or repetitive.

Data Protection Authority Contact

You have the right to lodge a complaint with a supervisory authority if you believe we have violated GDPR. You can find your national data protection authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

However, we encourage you to contact us first so we can address your concerns directly.

Updates to This Statement

We may update this GDPR Compliance Statement from time to time to reflect changes in our data processing practices, legal requirements, or organizational structure.

How We Notify You of Changes

• Effective date: The "Last Updated" date at the top of this page will always reflect the most recent version
• Material changes: For significant changes that affect your rights or how we process your data, we will provide prominent notice on our homepage for at least 30 days
• Continued use: Your continued use of our website after changes take effect constitutes acceptance of the updated statement

Version History

• December 29, 2025: Initial GDPR Compliance Statement published

Reviewing Changes

We encourage you to review this statement periodically, especially if you are a regular visitor. You can always find the most current version at this URL.

Additional GDPR Resources

For more information about GDPR and your rights as an EU/EEA/UK resident:

• European Commission: Official GDPR information
• European Data Protection Board: Guidelines and recommendations
• Your national data protection authority: Contact details available at EDPB member list