GDPR & Personal data protection

1. Introduction and Legal framework

The GDPR establishes the legal framework governing the protection of natural persons with regard to personal data processing and the free movement of such data within the European Economic Area (EEA).

Echo Escorts is committed to:

• Processing all personal data with appropriate care and in accordance with applicable legislation
• Implementing technical and organizational measures to protect personal data from unauthorized access, loss, or misuse
• Maintaining transparent policies governing what data is collected, why, and under what conditions
• Respecting and facilitating the exercise of data subject rights

This document is designed to inform you of your rights under GDPR and our corresponding obligations. If any section requires clarification, please contact us we – are committed to making data protection accessible and understandable.

2. Scope of data processing

Echo Escorts processes personal data only to the extent necessary for platform operations and in accordance with GDPR provisions.

2.1 Visitor data

Visitors browsing Echo Escorts leave minimal data traces. We may collect:

• IP address and approximate geographic location
• Browser type, version, and device information
• Pages viewed, time on site, and navigation patterns
• Referring URLs and session identifiers

This data does not directly identify individuals and is used for platform security, analytics, and performance optimization.

2.2 Advertiser data

Advertisers submitting profiles provide additional information necessary for listing creation and publication. Account information:

• Username and password
• Email address
• Phone number

Communication channels:

• WhatsApp, Telegram, or other contact methods

Profile information:

• Name or alias
• Location and areas of operation
• Physical parameters – height, weight, hair color, eye color, age
• Nationality and languages spoken
• Service descriptions and availability
• Photographs and visual content

Verification documents:

• Government-issued identification
• Age verification materials as required under 2257 compliance

2.3 Consent Conditions

Your consent is valid only when personal data is processed:

• To the extent necessary for stated purposes
• In accordance with applicable GDPR provisions
• As described in our Privacy Policy

3. Purpose and Legal basis for processing

3.1 Processing purposes

Personal data collected by Echo Escorts is processed for the following purposes:

• Service delivery. Creation, administration, and publication of advertising profiles within the directory.
• Verification. Age and identity verification in compliance with 18 U.S.C. § 2257 requirements.
• Communication. Responding to inquiries, providing technical support, sending account-related notifications.
• Security. Fraud prevention, abuse detection, unauthorized access prevention, and platform integrity maintenance.
• Legal compliance. Meeting regulatory obligations under GDPR, 2257, and other applicable laws.
• Platform improvement. Analyzing usage patterns and enhancing user experience through aggregated analytics.

3.2 Legal basis under GDPR Article 6

Our data processing activities rely on the following legal foundations:

• Consent (Article 6(1)(a)) – Marketing communications, optional data collection, cookie preferences.
• Contract performance (Article 6(1)(b)) – Advertising services, profile creation, account management.
• Legal obligation (Article 6(1)(c)) – Age verification, record-keeping under 2257 compliance, responding to lawful authority requests.
• Legitimate interest (Article 6(1)(f)) – Platform security, fraud prevention, service improvement, operational continuity.

4. International data transfers

Echo Escorts does not transfer personal data to any third country outside the EEA or to any international organization without appropriate safeguards.

Where cross-border transfers are necessary for operational purposes, we apply:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions recognizing equivalent protection in recipient jurisdictions
• Appropriate technical and organizational safeguards

For detailed information on data transfers, please refer to our Privacy Policy.

5. Data subject rights

Under GDPR, you possess the following rights regarding your personal data:

5.1 Right of Access (Articles 13, 14, 15)

You may request confirmation of whether personal data concerning you is being processed. If so, you may access that data along with information about processing purposes, data categories, recipients, and retention periods.

5.2 Right to Rectification (Article 16)

You may request correction of inaccurate personal data or completion of incomplete data without undue delay.

5.3 Right to Erasure – "Right to Be Forgotten" (Article 17)

You may request deletion of personal data when:

• Data is no longer necessary for its original purpose
• You withdraw consent where consent is the legal basis
• You object to processing and no overriding legitimate grounds exist
• Data has been unlawfully processed
• Erasure is required by applicable law

Certain data may be retained where legal obligations require, including 2257 Compliance records.

5.4 Right to Restriction of Processing (Article 18)

You may request restriction of processing under specific circumstances, including disputes over data accuracy or pending review of objection requests.

5.5 Right to Data Portability (Article 20)

You may receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.

5.6 Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes at any time. Where you object, we will cease processing unless compelling legitimate grounds override your interests.

5.7 Right Against Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects concerning you.

5.8 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

5.9 Right to Data Breach Notification (Article 34)

You have the right to be notified without undue delay if a personal data breach is likely to result in high risk to your rights and freedoms.

5.10 Right to Lodge a Complaint (Articles 13, 14, 15)

You may lodge a complaint with a competent supervisory authority in your Member State of residence, place of work, or place of alleged infringement.

6. Exercising your rights

6.1 Submission requirements

To exercise any right under GDPR, submit your request:

• Via email: [email protected]
• Include: Sufficient information to verify your identity
• Specify: The right(s) you wish to exercise and any relevant details

For advertisers, include your profile link or account email to expedite processing.

6.2 Identity verification

For your protection, we may request additional documentation to authenticate your identity before processing requests. This safeguard ensures personal data is not disclosed to unauthorized parties.

6.3 Response timeline

All requests are processed within GDPR-mandated timeframes:

• Standard requests – within 30 days of receipt
• Complex requests – extended to 60 days with prior notification
• Manifestly unfounded or excessive requests – may be refused or subject to reasonable administrative fee

7. Withdrawal of consent

If you have provided consent for personal data processing, you retain the right to withdraw that consent at any time.

How to withdraw:

• For advertisers. Submit a deletion request via email to [email protected]. Profile and associated data will be removed within 24-48 hours, subject to legal retention requirements.
• For visitors. Disable cookies through browser settings or discontinue platform use.

Important considerations:

• Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal
• Withdrawal may impact your ability to use certain platform features
• Certain data may be retained under legal obligations, including 2257 Compliance records

8. Data subject acknowledgment

By using the Echo Escorts platform, you acknowledge that:

• Provision of personal data is voluntary
• You have the right to withdraw consent without providing reasons
• You have the right to access, correct, and erase your data – subject to legal limitations
• You may object to processing and request data portability
• You may request human review in cases of automated decision-making
• Consent is given freely and is not conditional upon unrelated circumstances
• You understand the meaning and scope of this acknowledgment

9. Data security measures

Echo Escorts implements appropriate technical and organizational measures to protect personal data:

• SSL/TLS encryption for all data transmission
• Encrypted storage environments with access controls
• Role-based access limiting data visibility to authorized personnel
• Regular security audits and vulnerability assessments
• Staff confidentiality training and data handling protocols
• Incident response procedures for potential breaches

While no digital system can guarantee absolute security, we maintain industry-aligned protection standards. Detailed security information is available in our Privacy Policy.

10. Document updates

This GDPR & Personal Data Protection document is reviewed and updated regularly to reflect:

• Changes in applicable legislation
• Updates to platform operations
• Evolving data protection best practices

When significant changes occur:

• The "Last Updated" date will be revised
• Affected users may be notified via email or platform notice where feasible
• Continued use of Echo Escorts constitutes acknowledgment of updated terms

We encourage periodic review of this document to remain informed of current practices.

11. Contact information

For GDPR-related inquiries, requests, or complaints:

Email: [email protected]

Response times:

• General inquiries – within 48 hours
• Formal GDPR requests – within 30 days as required by law
• Complex requests – within 60 days with prior notification