Projection Genie’s Commitment to GDPR Compliance
Projection Genie is committed to protecting personal data in accordance with applicable data protection laws, including the European Union’s General Data Protection Regulation (“GDPR”) where it applies to our processing activities. The GDPR protects personal data relating to individuals in the European Economic Area (“EEA”) and may apply to organizations located outside the EEA in certain circumstances. This page describes measures Projection Genie uses to support GDPR compliance and should be read together with our Privacy Policy and, where applicable, our Data Processing Addendum.
What Projection Genie is doing to support GDPR compliance
Projection Genie maintains technical and organizational measures designed to protect personal data and periodically reviews its privacy, security, vendor management, and data handling practices.
When processing personal data subject to the GDPR:
- We process personal data only for specified purposes and in accordance with applicable legal requirements.
- We limit access to personal data to personnel and contractors who require access for legitimate business purposes and who are subject to appropriate confidentiality obligations.
- We maintain technical and organizational safeguards appropriate to the nature of the personal data and the risks associated with its processing.
- Where Projection Genie uses service providers to process personal data on its behalf, we require appropriate contractual, confidentiality, privacy, and security commitments.
- We maintain processes for responding to applicable data subject requests.
- We periodically review our privacy, security, and data processing practices and update them where appropriate.
- We maintain processes for responding to personal data breaches and providing notifications when required by applicable law.
GDPR Q&A
Does Projection Genie process customer personal data?
Yes. Projection Genie processes customer personal data only as needed to provide products, services, and customer support as identified in our Privacy Policy.
Projection Genie does not collect personally identifiable information for marketing purposes without customers’ consent, and customers may revoke consent at any time. (Projection Genie’s marketing includes a drip email campaign and an email newsletter.) Furthermore, Projection Genie has never sold PII to third parties and is committed to continuing this as a core business practice.
What data does Projection Genie process?
The personal data Projection Genie processes depends on how you use the Services and which features or integrations you enable.
Personal data may include account and contact information such as name, email address, mailing address, telephone number, account identifiers, profile information, IP address, device or usage information, and communications with Projection Genie.
When customers use Projection Genie’s financial planning and analysis products or connect third-party business systems, Projection Genie may also process information contained in accounting, billing, subscription, workforce, or other business records. Depending on the information provided by the customer or available through an authorized integration, this may include customer or employee names or identifiers, invoices, transactions, subscription information, payment status, employment or compensation-related information, and other information relating to identifiable individuals.
Projection Genie also processes business and financial information that does not identify a natural person. Such information is not personal data under the GDPR, although we continue to protect it in accordance with our contractual obligations and security practices.
For additional information regarding the categories of data we collect and how we use them, please review our Privacy Policy.
Is Projection Genie a data controller or data processor?
Projection Genie may act as either a controller or processor depending on the processing activity.
Projection Genie generally acts as a controller for personal data that it determines how and why to process for its own business operations, such as account administration, billing, website operations, customer support, security, and communications.
When a business customer submits or connects personal data to the Services for Projection Genie to process on that customer’s behalf, Projection Genie generally acts as a processor and the customer acts as the controller. In those circumstances, Projection Genie processes the personal data in accordance with the customer’s documented instructions and applicable contractual terms.
What legal bases does Projection Genie rely on?
Where Projection Genie acts as a controller and the GDPR applies, our legal basis for processing personal data depends on the particular activity and may include:
- Performance of a contract, where processing is necessary to provide Services requested by you;
- Legitimate interests, such as maintaining and securing the Services, preventing fraud, providing customer support, and improving our business and Services, where those interests are not overridden by the rights and freedoms of the individual;
- Consent, where consent is required or otherwise appropriate, including certain marketing communications; and
- Compliance with legal obligations, including applicable accounting, tax, regulatory, and legal requirements.
Where Projection Genie acts as a processor on behalf of a customer, the customer is responsible for determining the appropriate legal basis for the personal data it instructs Projection Genie to process.
How does Projection Genie handle data from third-party integrations?
Customers may choose to connect third-party business systems, including QuickBooks Online, Stripe, and other supported services, to Projection Genie. When a customer enables an integration, Projection Genie accesses and processes information made available through that integration as necessary to provide the requested Services.
Information obtained through connected services may include accounting information, subscriptions, invoices, customers or customer identifiers, products and pricing, payment status, transactions, currency information, and other business information. Where such information relates to an identified or identifiable natural person, Projection Genie treats it as personal data and processes it in accordance with applicable data protection requirements and our Privacy Policy.
Customers are responsible for ensuring that they have an appropriate legal basis and any necessary rights or permissions to provide personal data to Projection Genie through connected services.
How does Projection Genie handle Connected Services and MCP?
Certain Projection Genie Services may allow customers to connect third-party applications, artificial intelligence systems, assistants, agents, or other services through Model Context Protocol (“MCP”), APIs, or similar technologies (“Connected Services”).
When a customer or authorized User enables a Connected Service and initiates or authorizes a request, Projection Genie may transmit personal data or other information through that connection as necessary to fulfill the authorized request or action. Projection Genie processes such requests in accordance with the customer’s instructions and the permissions provided through the applicable connection.
Connected Services selected by customers are independently operated third-party services and are not automatically Projection Genie subprocessors. Once personal data is transmitted to a customer-selected Connected Service, that provider’s privacy practices, data processing terms, retention practices, and international data transfer mechanisms may apply.
Customers are responsible for determining whether their use of a Connected Service is appropriate for the personal data they choose to make available through the connection and for satisfying their obligations as a controller where applicable.
Disconnecting a Connected Service prevents future access through the Projection Genie connection but may not delete information previously transmitted to and retained by the third-party provider.
What rights do individuals have under the GDPR?
Subject to applicable law and the circumstances of the processing, individuals may have the right to request access to their personal data, correction of inaccurate personal data, deletion of personal data, restriction of processing, portability of certain personal data, and objection to certain processing. Where processing is based on consent, individuals may also withdraw consent at any time without affecting the lawfulness of processing performed before withdrawal.
Requests may be submitted to info@projectiongenie.com. We may take reasonable steps to verify the identity and authority of the person submitting a request.
Where Projection Genie processes personal data solely on behalf of one of our business customers, individuals may need to direct their request to that customer as the applicable data controller. Projection Genie will assist its customers with applicable data subject requests as required by our contractual and legal obligations.
Where does Projection Genie process and store personal data?
Projection Genie is based in the United States, and personal data may be processed in the United States and in other countries where Projection Genie’s authorized service providers or contractors operate.
When personal data subject to the GDPR is transferred outside the EEA, Projection Genie uses an applicable lawful transfer mechanism where required. Depending on the recipient and circumstances, this may include a European Commission adequacy decision, Standard Contractual Clauses approved by the European Commission, or another transfer mechanism permitted under applicable data protection law.
Projection Genie also requires appropriate contractual and security protections from service providers that process personal data on our behalf.
Additional information about our subprocessors and their processing locations is provided below.
You can sign-up to receive communication if Projection Genie adds or removes Subprocessors. To opt-in to receive such notifications, email us at info@projectiongenie.com.
More Resources
- Privacy Policy: https://www.projectiongenie.com/legal/privacy-policy
- Customer Agreement: https://www.projectiongenie.com/legal/customer-agreement
- GDPR Resources: http://ec.europa.eu/justice/data-protection/reform/index_en.htm
