Legal
GDPR Rights
Last updated: July 2026
This page sets out rights available to individuals located in the European Union and European Economic Area ("EU/EEA") under the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Vantro Pty Ltd is committed to processing personal data lawfully, fairly, and transparently.
1. Applicability
The rights and information described on this page apply to individuals who reside in the EU or EEA and whose personal data is processed by Vantro. If you are not located in the EU/EEA, please refer to our general Privacy Policy for information about how we handle personal data globally.
For the purposes of the GDPR, Vantro Pty Ltd acts as the data controller for personal data collected from EU/EEA residents who use Vantro.ai directly.
2. Lawful Basis for Processing
We only process personal data where we have a valid lawful basis. Depending on the context, we rely on one or more of the following legal bases under Article 6 of the GDPR:
Contractual Necessity
Processing is necessary to perform our contract with you, including account creation, authentication, subscriptions, payments, AI agent access, and requested platform services.
Legitimate Interests
We process certain data where it is in our legitimate interests and those interests are not overridden by your rights, including security, fraud prevention, abuse detection, service reliability, and product improvement using first-party operational data.
Legal Obligation
We may process or retain data where required by applicable law, including tax, accounting, dispute, and lawful authority requirements.
Consent
Where we rely on consent, such as for optional marketing emails, you may withdraw consent at any time without affecting processing already carried out before withdrawal.
3. Your Rights Under the GDPR
As a data subject under the GDPR, you may have the following rights in relation to your personal data:
Right of Access (Art. 15)
You may request confirmation of whether we process personal data about you and receive a copy of that data with information about how it is processed.
Right to Rectification (Art. 16)
You may request correction of inaccurate personal data and completion of incomplete personal data.
Right to Erasure (Art. 17)
You may request deletion of personal data where it is no longer needed, you withdraw consent where consent is the basis, or another GDPR erasure ground applies.
Right to Data Portability (Art. 20)
Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21)
You may object to processing based on legitimate interests, including related profiling, subject to applicable legal grounds.
Right to Restriction (Art. 18)
You may request restricted processing in certain circumstances, such as while accuracy or objection grounds are being reviewed.
To exercise these rights, contact Vantro at privacy@vantro.ai. We aim to respond to verifiable requests within 30 days. Where requests are complex or numerous, we may extend this period as permitted by law and will notify you.
4. Privacy Contact
Vantro uses a privacy contact for launch-current GDPR requests. A separate statutory appointment is not recorded in this launch package. For rights requests or questions about data practices, contact:
Privacy - Vantro Pty Ltd
Email: privacy@vantro.ai
Please include "GDPR Rights Request" in the subject line of your email.
5. International Data Transfers
Vantro Pty Ltd is incorporated in Australia and may use service providers in Australia, the United States, and other countries. Where GDPR transfer rules apply, Vantro will rely on appropriate transfer safeguards before transferring personal data from the EU/EEA to a country without an applicable adequacy decision.
- Standard Contractual Clauses approved by the European Commission where required.
- Transfer impact and vendor review appropriate to the data, service, and country involved.
- Other approved transfer mechanisms where applicable.
6. Right to Complain to a Supervisory Authority
If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU/EEA member state where you reside, work, or where the alleged infringement took place.
A list of EU supervisory authorities is available on the European Data Protection Board website at www.edpb.europa.eu.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, security, dispute, and reporting requirements.
Upon account closure, we delete or anonymise personal data within 90 days, except where retention is required for a legal obligation, dispute, billing record, security investigation, or enforcement of our agreements. Backup copies expire through the regular backup rotation lifecycle.
8. Contact
For GDPR-related enquiries, rights requests, or privacy questions, please contact:
Vantro Pty Ltd
Email: privacy@vantro.ai