Echoes
    Legal

    GDPR Compliance

    Last updated:

    Privacy by Design

    At Echoes Srl. SB, data protection is not a compliance checkbox - it is an architectural principle embedded into every system, process, and decision from inception. We build privacy into the foundation, not as an afterthought.

    Our Four Pillars

    Data Minimization

    We collect only the personal data strictly necessary for regulatory compliance (AML/KYC), contractual obligations, and legitimate business operations. No data is collected 'just in case.'

    AES-256 Encryption

    All personal and financial data is encrypted at rest using AES-256 and in transit using TLS 1.3. Encryption keys are managed through hardware security modules (HSMs) within EEA-based data centers.

    Role-Based Access Control

    Access to personal data is governed by strict RBAC policies. Only authorized personnel with a documented business need can access specific data categories. All access is logged and auditable.

    EEA-Only Data Storage

    All personal data is stored exclusively within the European Economic Area. We do not transfer data to third countries. Our cloud infrastructure partners are contractually bound to EEA-only processing.

    Regulatory Framework

    Our data protection practices are aligned with:

    • GDPR (Regulation (EU) 2016/679) - Full compliance with all articles including Data Protection by Design (Art. 25), Data Protection Impact Assessments (Art. 35), and Breach Notification (Art. 33).
    • ePrivacy Directive (2009/136/EC) - Cookie consent and electronic communications compliance.
    • AML Directive (EU 2015/849) - Data processing for anti-money laundering and counter-terrorism financing obligations.
    • ECB/SSM Supervisory Requirements - Data governance standards expected of licensed banking institutions.

    Data Protection Impact Assessments

    We conduct formal DPIAs for all processing activities that present a high risk to data subjects, including capital provider onboarding, AML/KYC screening, and partner capacity assessments. DPIAs are reviewed annually and upon any material change to processing operations.

    Breach Response Protocol

    In the event of a personal data breach, we maintain a 72-hour notification protocol as required by GDPR Article 33. Our incident response team operates a documented playbook covering:

    • Immediate containment and forensic assessment
    • Supervisory authority notification within 72 hours (Garante / Lithuanian SDPI)
    • Affected individual notification without undue delay where required
    • Post-incident review and remediation

    Your Rights & Contact

    For all data protection inquiries, subject access requests, or to report a concern, contact our Data Protection Officer:

    Data Protection Officer
    Echoes Srl. SB
    Via Fatebenefratelli 15, Milan, Italy
    info@echoes-holding.eu