GDPR Compliance

Our Commitment

AAMOS is committed to compliance with the General Data Protection Regulation (EU 2016/679). We act as a data processor for our customers and have implemented technical and organisational measures to meet our Article 28 obligations. Our EU operations are managed by Landvex AB, Sweden.

Legal Entities

Legal Basis for Processing

Processing Activity	Legal Basis (GDPR Art.)
Account management and authentication	Art. 6(1)(b) — Contractual necessity
API usage logs	Art. 6(1)(b) — Contractual necessity
Billing and payment	Art. 6(1)(b) — Contractual necessity; Art. 6(1)(c) — Legal obligation
Security monitoring	Art. 6(1)(f) — Legitimate interests
Processing customer-submitted biometric data	Art. 9(2)(a) — Explicit consent of data subject (controlled by customer)
Service communications	Art. 6(1)(b) — Contractual necessity

Data Subject Rights

AAMOS respects and facilitates the following rights for data subjects whose data we process:

• Art. 15 — Right of access: Obtain confirmation and a copy of personal data processed.
• Art. 16 — Right to rectification: Have inaccurate data corrected.
• Art. 17 — Right to erasure: Request deletion of personal data ("right to be forgotten").
• Art. 18 — Right to restriction: Restrict processing in specific circumstances.
• Art. 20 — Right to portability: Receive personal data in structured, machine-readable format.
• Art. 21 — Right to object: Object to processing based on legitimate interests.
• Art. 22 — Automated decisions: Not be subject to solely automated decisions with significant effect.

To exercise any right, contact privacy@landvex.com. We respond within 30 days.

International Data Transfers

Where personal data is transferred from the EU/EEA to the United States, such transfers are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission in Decision 2021/914. A copy of the applicable SCCs is available on request.

Data Transfers to Sub-Processors

Sub-processor transfers are covered by back-to-back SCCs or EU adequacy decisions. See our Data Processing Agreement for the current sub-processor list.

Supervisory Authority

Data subjects may also lodge a complaint with the supervisory authority in their country of residence.

DPO Contact

Data protection enquiries: privacy@landvex.com