GDPR & Data Rights
Your rights under the General Data Protection Regulation (GDPR / RGPD) and how Manoova SARL enables you to exercise them.
Last updated: 6 April 2026
Sobber's Commitment to GDPR
Manoova SARL is designed from the ground up for GDPR compliance. As a platform that processes biometric data (facial recognition) and health data (blood alcohol content results) — both classified as special category data under GDPR Article 9 — we take data protection obligations extremely seriously.
Manoova SARL
Registered office: II J 173 B Ivandry, Antananarivo, Madagascar
Share capital: MGA 1,000,000,000 (1 billion Malagasy Ariary)
Contact: contact@sobber.io
Hosting: Vercel Inc., 440 N. Barranca Ave #4133, Covina, CA 91723, United States — vercel.com
This page explains your rights as a data subject, how to exercise them, and how Sobber's architecture supports compliance for both individual workers and enterprise clients.
Your Eight Rights Under GDPR
Right of Access (Art. 15)
You have the right to request a copy of all personal data Sobber holds about you, including the legal basis for processing, retention periods and who your data has been shared with.
Right to Rectification (Art. 16)
You may request correction of inaccurate personal data. If your name, role or other identity information is incorrect in Sobber's system, you may request its rectification.
Right to Erasure (Art. 17)
You may request deletion of your personal data. Note: BAC results and audit logs may be subject to mandatory retention periods under employment law and EN 15964, which may limit this right.
Right to Restriction (Art. 18)
You may request that processing of your data be restricted in certain circumstances — for example, while a dispute about data accuracy is being resolved.
Right to Data Portability (Art. 20)
You may receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and have it transmitted to another controller where technically feasible.
Right to Object (Art. 21)
You may object to processing based on legitimate interests. Sobber will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on your consent (e.g., biometric enrolment in jurisdictions requiring explicit consent), you may withdraw that consent at any time without penalty to other services.
Right to Lodge a Complaint (Art. 77)
If you believe Sobber has violated your data protection rights, you have the right to lodge a complaint with your national supervisory authority.
How to Exercise Your Rights
Contact your employer first
In most cases, your employer (the data controller) is responsible for managing your personal data within Sobber. Contact your HR or HSE department. They can submit a data subject request on your behalf.
Contact Sobber directly
If your employer cannot or will not assist you, contact Sobber directly at contact@sobber.io with the subject line "Data Subject Request". Include your full name and the organisation you work for.
Verification & response
Sobber will verify your identity and respond within 30 days. Complex requests may be extended by an additional 60 days with notification. There is no charge for a first request within any 12-month period.
Special Category Data — Additional Protections
Sobber processes two types of special category data that require heightened protection under GDPR Article 9:
- Biometric data — facial images and biometric templates. These are encrypted with AES-256 and stored in a segregated database, separate from BAC results. Only designated HR/compliance personnel have access.
- Health data — BAC results. Classified as health data under GDPR. Processed under the legal basis of occupational health and safety obligations (Art. 9(2)(b)), or explicit consent where required by national law.
Sobber never uses biometric or health data for purposes other than the specific workplace compliance programme for which it was collected.
Data Processing Agreement (DPA)
Sobber provides a full Data Processing Agreement to all enterprise clients as required by GDPR Article 28. The DPA covers:
- Subject matter, duration, nature and purpose of processing
- Type of personal data and categories of data subjects
- Obligations and rights of the controller (employer)
- Sub-processors used by Sobber and applicable safeguards
- Breach notification procedures (72-hour notification)
- Audit rights
To request a DPA, contact contact@sobber.io.
Supervisory Authorities
For operations in Africa and the Middle East, Sobber cooperates with applicable national data protection authorities and implements appropriate safeguards for international transfers.
Exercise your rights or request documentation
Data subject requests, DPA requests and compliance questions answered within 30 days.
contact@sobber.io