Is Enrich Layer GDPR and CCPA compliant?
How Enrich Layer meets GDPR and CCPA requirements, the lawful basis for our data processing, and how to exercise your data rights.
Yes. Enrich Layer processes personal data in accordance with GDPR principles and offers CCPA/CPRA-aligned rights to every user, not just California residents. This article covers our compliance posture, the lawful basis we rely on, and how to exercise your data rights.
For questions about SOC 2, penetration testing, or our broader security posture, see our Security & Compliance FAQ.
GDPR compliance
Enrich Layer processes personal data in line with GDPR's core principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.
If GDPR applies to our processing of your personal data, you have the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. See Your data rights below for how to exercise these.
CCPA / CPRA compliance
We extend CCPA/CPRA-style rights — the right to know, delete, correct, and opt out of the sale or sharing of personal information — to users regardless of where they live, not only California residents.
Enrich Layer is also registered as a data broker in California through the CA DROP system, consistent with our obligations under California's data broker registration requirements.
Lawful basis for data processing
Our lawful basis depends on the relationship:
- Platform users (our customers): processing is based on the performance of our contract with you, your consent, or our legitimate interests in operating and securing the Service.
- Individuals in our enrichment database: where we rely on "legitimate interests" as the lawful basis — for example, providing B2B intelligence to help businesses identify and connect with relevant prospects — we weigh that interest against the rights and freedoms of the individual, and you can object to this processing at any time (see below).
We source data from publicly accessible sources (business registries, company websites, professional networking platforms, news, press releases) and from data partners and compilers who are contractually required to have the legal right to share that data with us. We conduct due diligence on third-party sources and don't use data from sources that fail our compliance standards or that are private.
Your data rights
You have the following rights over your personal data, regardless of jurisdiction:
| Right | Legal basis | What it means |
|---|---|---|
| Right to Know / Access | GDPR Art. 15 · CCPA §1798.100 | Request a full disclosure of the personal information we've collected, used, disclosed, or sold about you. |
| Right to Correct | GDPR Art. 16 · CPRA §1798.106 | Ask us to fix inaccurate or outdated data and propagate the correction to sub-processors. |
| Right to Erasure / Deletion | GDPR Art. 17 · CCPA §1798.105 | Request permanent deletion of your profile from our systems and sub-processor partners. |
| Right to Opt-Out of Profiling | GDPR Art. 22 · CCPA §1798.121 | Opt out of automated profiling, data sales, and sharing for commercial purposes. |
| Right to Data Portability | GDPR Art. 20 · CPRA | Receive a structured, machine-readable copy (JSON or CSV) of your data. |
| Right to Limit Sensitive Data | CPRA | Limit use and disclosure of any sensitive personal information. |
How to exercise these rights: Visit our Trust Center to find your profile and submit a request, or contact our Data Protection Officer directly. We verify your identity before acting on any request. Once verified, we process deletion, correction, and opt-out requests across our full data ecosystem — including all sub-processors — and provide written confirmation when complete. For submission steps and the current response timeline, see Can I Request to Delete My Data?.
DPA and Privacy Policy
- Privacy Policy: enrichlayer.com/privacy-policy — full detail on what we collect, how we use it, who we share it with, and your rights by jurisdiction.
- Data Processing Agreement (DPA): If you're a customer and Enrich Layer processes personal data on your behalf as a processor, a DPA is available — contact us to request a signed copy.
- Trust Center: enrichlayer.com/trust-center — subprocessor list, your rights, and the privacy request portal.
Still have questions?
Contact us and we'll get back to you-contact support.