Privacy policy

1. Controller

Complass GmbH
Kölner Tor 31
40625 Düsseldorf
Represented by the managing director: Marc Linden
Phone: +49 211 5423 585-0
Email: info@complass.eu

2. General information on data processing

As a general rule, we only process personal data to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with your consent or on the basis of Art. 6(1)(b), (c) and (f) GDPR.

Recipients and transfers to third countries: within our company, your data is only received by the people who need it for the respective task. Outside our company, data is only received by the service providers named in this policy, mostly as processors under Art. 28 GDPR, and by bodies to which we are legally obliged to transfer data (for example tax authorities). Data is only transferred to countries outside the EU where we expressly say so in this policy, in each case on the basis of an adequacy decision or standard contractual clauses (Art. 45, 46 GDPR).

Obligation to provide data: you do not have to provide any data to visit the website. For a request, an order or a user account we need the details marked as required; without them we cannot handle the request or conclude the contract. There is no legal obligation to provide the data.

No automated decision-making: we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Withdrawal: you can withdraw any consent at any time with effect for the future, for example by emailing info@complass.eu. The lawfulness of the processing up to the withdrawal remains unaffected (Art. 7(3) GDPR).

3. Hosting

This website and the customer area run on our own servers, which we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server for the website and the customer area is located in a Hetzner data centre in Nuremberg; the encrypted backups, the backup copy of the logs and our log server are located in a Hetzner data centre in Falkenstein (Vogtland). Emails from the customer area and about our forms are sent via Hetzner's mail server. All locations are in Germany; hosting involves no transfer to countries outside the EU. Hetzner processes the data only on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Email and collaboration: our mailboxes, Microsoft Teams and our email communication with you (for example about enquiries, quotes and support) run in our Microsoft 365 account with Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, within Microsoft’s EU Data Boundary. Microsoft processes the data as our processor under Art. 28 GDPR. Microsoft Ireland is a subsidiary of Microsoft Corporation in the USA; for transfers to the USA in individual cases, for example for support or security services, the adequacy decision on the EU-US Data Privacy Framework applies (Art. 45 GDPR), otherwise the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). System messages from the customer area are still sent via Hetzner’s mail server. The legal basis is Art. 6(1)(b) GDPR and, where we answer general enquiries, Art. 6(1)(f) GDPR.

4. Server log files

With every request our web server records in so-called server log files: the time, the requested address, the request method, protocol and encryption details of the connection, the status code, the amount of data transferred, the response time and your IP address in shortened form (for IPv4 without the last byte, for IPv6 only the first 48 bits). One-time keys and identifiers from links in our emails are replaced by a placeholder before storage. Browser details, referrer, cookies and other request headers are not stored in the log files; requests to whistleblower systems are not logged by the web server at all. The purpose is secure and stable operation, in particular detecting attacks and faults. This data is not merged with other data sources. The log files stay on the server for up to 30 days and are transferred for evaluation to our log server in Germany, where we delete them after 90 days. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation).

5. Fonts and external content

The fonts Marcellus and Work Sans as well as all images and scripts are loaded locally from our own server. There is no connection to external providers such as Google Fonts or content delivery networks; your IP address is not transmitted to third parties when the page loads. The only exception is the visitor statistics on the public pages (section 7).

6. Cookies and local storage

We only use strictly necessary cookies. The session cookie contains a random identifier, protects forms against misuse (CSRF protection) and keeps you signed in to the customer area. It becomes invalid when you close your browser or sign out. If you choose a language yourself, your browser remembers this choice in a language cookie (only the language code, e.g. "en", valid for one year) so that the website and sign-in page appear in your language. After you sign in to the customer area, we set a device cookie. It contains a random, signed identifier and serves only to recognise your browser as a known device, so that we warn you by email only about sign-ins from new devices, even if your IP address changes (e.g. with iCloud Private Relay, a VPN or mobile networks). We store only an encrypted value derived from this identifier. The device cookie is valid for one year, is renewed with every sign-in and remains after you sign out. You can delete it in your browser at any time; your browser will then count as a new device the next time you sign in from a different network. When you open a link from one of our e-mails, your browser keeps its one-time key for a few seconds in a technically necessary cookie (at most 5 minutes), so the key does not stay in the address bar. If you close a notice bar on the home page about a pilot programme (cookie “cx_pilot_bar”) or about a promotion (cookie “cx_promo_bar”), your browser remembers this in a cookie so the bar does not appear again: for the pilot programme only the value “0”, for a promotion only the ID of the closed promotion. Both cookies are valid for one year, contain no personal identifier and are not passed on to third parties. Your choice between light and dark design is stored locally by your browser (local storage); this information is not transmitted to us. If you sign in to the mailbox of a whistleblower system, a strictly necessary cookie keeps you signed in until you close your browser. In the customer area your browser also stores operating preferences locally (local storage or session storage), such as opened help panels, the order of comments, the progress of a page tour and settings for browser notifications; some settings, such as the collapsed navigation, are also stored in your user account. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

7. Visitor statistics (Plausible Analytics)

To understand how our public website is used, we use the analytics service Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Only the public pages of complass.eu are measured, not the customer area, the sign-in or the forms. Signed-in users are not counted. Plausible does not use cookies, stores nothing on your device and does not create user profiles. When you visit a page, the page address (of its parameters, only the page and language identifiers and campaign identifiers such as utm_source are kept), the referring page (referrer), browser, operating system, device type, the language of the page and the country or region derived from the IP address are transmitted. The IP address itself is not stored: together with the browser identifier and a random value that changes daily, it is converted into an irreversible identifier that loses its reference after 24 hours. We also record anonymously whether a link to a demo, partner or other request or to the sign-in, an email or phone link, an external link or a download is clicked, and whether a request was submitted via the form (only the event and the kind of request, no form content). The data is processed exclusively on servers in the European Union and evaluated only in aggregated form. We have concluded a data processing agreement with Plausible pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in designing our website according to demand (Art. 6(1)(f) GDPR). You may object to this processing at any time (Art. 21 GDPR), e.g. by sending a message to info@complass.eu or by using a content or script blocker in your browser.

In the tour at complass.eu/en/tour we count on our own server how often a chapter is started, storing only the chapter, language, day and count, without IP address, cookie, browser details or referring page. To protect against abuse we briefly process an encrypted value derived from your IP address (not the plain IP) for rate limiting, as for our forms.

Beyond this, we do not use any tracking or advertising services, nor any cookies for marketing or statistical purposes. There is no visitor statistics in the customer area.

8. Demo, partner and other requests

You can use the form on complass.eu to request a demo, a partnership or a quote, or to send us another enquiry. Required are your name, company and email address; optionally you can provide your phone number (for a call back) and select what your request is about (e.g. NIS2, Cyber Resilience Act, ISO 27001, IEC 62443). If you come from the price configurator, we send your selection there along with it. The data is stored in a database on servers in Germany; a copy is sent to our mailbox for processing. To prevent abuse we additionally store an encrypted value derived from your IP address (not the plain IP). Requests sent via an earlier, more detailed version of the form may also contain position, message and further optional details.

Source of your request: if you reached us through a link that names a source (price configurator, AI assistant on our website, or the personal link of a member of our team), we store this source together with your request; for a team link we store which member of our team issued the link. We use this information to evaluate which paths lead to requests and to attribute a request to the member of our team whose link it came through. The legal basis is our legitimate interest in planning our sales work and in tracing introductions by our team (Art. 6(1)(f) GDPR). We set no cookie for this, and we do not count who opens such a link. You can object to this processing on grounds relating to your particular situation (Art. 21(1) GDPR, section 10); to do so, write to info@complass.eu. We delete the source together with your request (see the periods below). Partner codes are described in section 9a.

After sending the form you can optionally “prepare the conversation”, each from predefined options: industry, company size (employees), occasion or deadline (e.g. planned audit, customer requires proof, NIS2, CRA, Machinery Regulation) and, for demo requests, the preferred time. This step can be skipped and is available for up to 48 hours after sending or confirming. We use these details to tailor the demo and our offer to your company and to organise requests internally; from them we derive an internal rough first assessment of which frameworks may apply to you. This assessment is not a legal review and not an automated decision within the meaning of Art. 22 GDPR. Without these details we process your request in the same way. Storage, legal basis and deletion as for the other form details.

The legal basis for handling your request is Art. 6(1)(b) GDPR (pre-contractual measures); we do not need your consent for it. You confirm requests via a link in an email (double opt-in); unconfirmed requests are deleted automatically after 30 days.

If you also tick the optional box in the form, we send you occasional information about Complass by email. The legal basis is then your consent under Art. 6(1)(a) GDPR, which you confirm with the same link. Without the box we handle your request in the same way. You can withdraw this consent at any time with effect for the future, via the unsubscribe link in each of these emails or by emailing info@complass.eu; the lawfulness of the processing up to the withdrawal remains unaffected. We delete your data no later than twelve months after the last contact, unless a further business relationship arises.

In the past you could additionally join a waiting list. We now process these details on the basis of the consent you gave then, only to inform you as promised, and delete them after the periods stated above or after your withdrawal.

8a. Applicability check

The applicability check at complass.eu/en/applicability-check evaluates your answers exclusively in our server’s working memory to show you a result immediately. Your inputs are not stored in your session, not in the server log files and not together with your IP address or any other information about you. For anonymous demand statistics we store after the evaluation only which of the given answer options you chose (no free text and no numbers of your own), the result, the language of the page, the day (without time of day), and the country and, for Germany, Austria and Switzerland, the state or canton the request came from. We determine country and region on our own server from your IP address using a local database (DB-IP); the IP address is used only in working memory for this and is not stored. Only the sales team and management of Complass evaluate the statistics, in aggregated form; values below three are not shown. We use them to align our offer and our advertising with actual demand and do not pass them on to third parties or advertising networks. We delete individual entries after 13 months; after that only monthly totals per country and result remain. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offer according to demand). If you do not want to be counted, tick “Do not count my answers in the anonymous statistics” in the form. A later objection can only apply to future use, because we cannot attribute a stored entry to you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Only if you explicitly click “Send result with demo request” in the result do we pass a short text summary calculated from your answers to the enquiry form. The summary itself contains no contact data; it only becomes part of your personal data once you send it together with your enquiry, and even then only if you additionally tick the separate, not pre-checked consent “Send the result of my applicability check with this request” there. The legal basis for this handover is your consent under Art. 6(1)(a) GDPR and, for the demo request itself, Art. 6(1)(b) GDPR (pre-contractual measures) as under section 8. Without this click and this checkbox, the check stores no information about you; the paragraph above applies to the anonymous demand statistics.

Because submitting the form (evaluating or sending the result) technically requires a session, doing so sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG; simply reading the page sets no cookie.

To protect against abuse we count requests per IP address (rate limiting, no plain-text log of the answers); the legal basis is Art. 6(1)(f) GDPR (security of the service).

8b. CRA reporting deadline calculator

The CRA reporting deadline calculator at complass.eu/en/cra-reporting-deadlines calculates the reporting deadlines from your inputs (type of report, point of awareness, time zone and, where applicable, further points in time) exclusively in our server’s working memory. Your inputs are not stored in your session, not in the server log files and not together with your IP address or any other information about you. For anonymous demand statistics we store after the evaluation only which of the given answer options you chose (type of report, time zone and whether a further point in time was given; no points in time), the result, the language of the page, the day (without time of day), and the country and, for Germany, Austria and Switzerland, the state or canton the request came from. We determine country and region on our own server from your IP address using a local database (DB-IP); the IP address is used only in working memory for this and is not stored. Only the sales team and management of Complass evaluate the statistics, in aggregated form; values below three are not shown. We use them to align our offer and our advertising with actual demand and do not pass them on to third parties or advertising networks. We delete individual entries after 13 months; after that only monthly totals per country and result remain. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offer according to demand). If you do not want to be counted, tick “Do not count my answers in the anonymous statistics” in the form. A later objection can only apply to future use, because we cannot attribute a stored entry to you. They are transmitted by POST and therefore do not appear in the address or in the server log files either. The result is not passed to any other form. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Simply reading the page sets no cookie. As with the applicability check, submitting the calculation sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG. To protect against abuse we count requests per IP address (rate limiting, no log of the inputs); the legal basis is Art. 6(1)(f) GDPR (security of the service). If you request a demo via the links in the result, section 8 applies.

8c. AI risk class check

The AI risk class check at complass.eu/en/ai-risk-check classifies an AI system from your inputs (role, use cases and properties of the system) exclusively in our server’s working memory. Your inputs are not stored in your session, not in the server log files and not together with your IP address or any other information about you. For anonymous demand statistics we store after the evaluation only which of the given answer options you chose (role, Annex III areas and the answers on conformity assessment and profiling; no free text), the result, the language of the page, the day (without time of day), and the country and, for Germany, Austria and Switzerland, the state or canton the request came from. We determine country and region on our own server from your IP address using a local database (DB-IP); the IP address is used only in working memory for this and is not stored. Only the sales team and management of Complass evaluate the statistics, in aggregated form; values below three are not shown. We use them to align our offer and our advertising with actual demand and do not pass them on to third parties or advertising networks. We delete individual entries after 13 months; after that only monthly totals per country and result remain. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offer according to demand). If you do not want to be counted, tick “Do not count my answers in the anonymous statistics” in the form. A later objection can only apply to future use, because we cannot attribute a stored entry to you. They are transmitted by POST and therefore do not appear in the address or in the server log files either. The result is not passed to any other form. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Simply reading the page sets no cookie. As with the applicability check, submitting sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG. To protect against abuse we count requests per IP address (rate limiting, no log of the inputs); the legal basis is Art. 6(1)(f) GDPR (security of the service). If you request a demo via the links in the result, section 8 applies.

8d. Whitepapers

Via complass.eu/en/whitepapers you can request whitepapers on individual frameworks (e.g. NIS2, Cyber Resilience Act) as a PDF. Your email address is required; name and company are optional. We store these details together with an encrypted value derived from your IP address (not the plain IP) in a database on servers in Germany and email you a download link (valid for 7 days, usable up to 5 times). The legal basis is Art. 6(1)(b) GDPR (fulfilling your request, a pre-contractual measure).

When submitting the form you can additionally and independently give two optional, not pre-ticked consents: (a) information by email about new and updated whitepapers, and (b) contact for a no-obligation conversation. Downloading the whitepaper does not depend on either consent. You confirm both via a separate link in the same email (double opt-in); without confirmation they do not take effect. The legal basis is your consent under Art. 6(1)(a) GDPR. If you confirm (b), we additionally copy your details into our lead management (see section 8) and a member of our team will contact you personally.

You can withdraw consent (a) at any time with effect for the future, via the unsubscribe link in every further email or by emailing info@complass.eu. Deletion periods: without confirmed consent we delete the request after 30 days; with confirmed consent (a) we delete it no later than 24 months after the last email to you; after withdrawal with no other active consent we delete it after a further 30 days. A confirmed contact request (b) follows the retention of our lead management (section 8). We do not pass your data on to third parties. Our visitor statistics (section 7) additionally apply to the use of these pages: there we record anonymously that a whitepaper was requested and which one, without form contents or email address. Separately from your request, we also count for our anonymous demand statistics which whitepaper was requested in which language, with day (without time of day), country and, for Germany, Austria and Switzerland, state or canton (derived from the IP address on our server; the IP address is not stored for this), without email address, name, company or form contents; evaluation, retention and legal basis as described in section 8a. If you do not want to be counted, tick “Do not count my request in the anonymous statistics” in the form.

Direct sending at your request: if you ask a member of the Complass team in person for a whitepaper, for example in a conversation at a trade fair or by phone, we email it to you with a download link (valid for 7 days, usable up to 5 times). We store your email address, name and company (if given), the whitepaper and language, the occasion and date of the conversation, the sending team member and the number of downloads, and record the request in our lead management, expressly without consent to advertising. The email contains all privacy information and no advertising. The only recipient is our host Hetzner (section 3: hosting, mailbox and email delivery in Germany) as processor; there is no transfer to countries outside the EU. The legal basis is Art. 6(1)(b) GDPR, for requests on behalf of your company Art. 6(1)(f) GDPR; for the record Art. 6(1)(f) GDPR (documenting our business contacts and proving that it was sent). You can object at any time. We only send advertising or newsletters with your express consent. We delete the details 12 months after sending, or immediately after an objection.

Partner whitepaper: if we are talking with you or your company about a possible partnership, the sales team or management of Complass sends you our confidential partner whitepaper by email with a download link (valid for 7 days, usable up to 5 times) or as an attachment. Each copy carries the name of your company and a copy number. We store name, company and email address, the document, language and version, the copy number, the date and the sending team member, and the number of downloads, so that we can prove who received which confidential copy. This does not add you to our lead management, and it involves no advertising or newsletters. The only recipient is our host Hetzner (section 3) as processor; there is no transfer to countries outside the EU. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), for the record Art. 6(1)(f) GDPR (traceability of confidential documents). You can object at any time. We delete the issued file 30 days after the link expires and the record 12 months after sending, or immediately after an objection.

8e. Waiting list for individual packages (existing entries)

Until 10 October 2026 you could join a waiting list on our pages for industries and roles for a package that could not be booked yet. New sign-ups are no longer possible. We process existing entries only until they are deleted under the following rules. Stored are your email address, the company and name if you gave them, the selected package, the page you came from (industry or role), the language, the wording of your consent, the time and, to prevent abuse, an encrypted value derived from your IP address (not the plain IP). The data is stored in a database on servers in Germany.

The sole purpose is to notify you once by email as soon as the package can be booked. The legal basis is your consent under Art. 6(1)(a) GDPR. If you had not yet confirmed your sign-up via the link in our email (double opt-in), you can still do so within the period stated there; unconfirmed entries are deleted automatically 30 days after the sign-up. After the notification we delete your entry. If the package does not become bookable within 24 months of your confirmation, we delete it at that point at the latest.

You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every waiting-list email or by emailing info@complass.eu. Your entry is then deleted immediately. We do not pass your data on to third parties.

8f. Compliance cost calculator

The compliance cost calculator at complass.eu/en/compliance-cost-calculator estimates the costs, internal effort and duration of an implementation from your inputs (framework, company size, scope, prior knowledge, sector and, where applicable, your own assumptions such as day rate, cost of a working hour and hours per week), exclusively in our server’s working memory. Your inputs are not stored in your session, not in the server log files and not together with your IP address or any other information about you. For anonymous demand statistics we store after the evaluation only which of the given answer options you chose (framework, size, scope, prior knowledge, sector, whether own assumptions were changed, whether the PDF was downloaded, and a band of the estimated amount; no own assumptions such as day rate or hours), the result, the language of the page, the day (without time of day), and the country and, for Germany, Austria and Switzerland, the state or canton the request came from. We determine country and region on our own server from your IP address using a local database (DB-IP); the IP address is used only in working memory for this and is not stored. Only the sales team and management of Complass evaluate the statistics, in aggregated form; values below three are not shown. We use them to align our offer and our advertising with actual demand and do not pass them on to third parties or advertising networks. We delete individual entries after 13 months; after that only monthly totals per country and result remain. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offer according to demand). If you do not want to be counted, tick “Do not count my answers in the anonymous statistics” in the form. A later objection can only apply to future use, because we cannot attribute a stored entry to you. They are transmitted by POST and therefore do not appear in the address or in the server log files either. Only the preselection of a sector or framework via a link from our pages appears in the address. The result is not passed to any other form. If you download the result as a PDF, your inputs are transmitted again by POST and processed in working memory only to create the file; the PDF file is not stored on our side either. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Simply reading the page sets no cookie. As with the applicability check, submitting the calculation sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG. To protect against abuse we count requests per IP address (rate limiting, no log of the inputs); the legal basis is Art. 6(1)(f) GDPR (security of the service). If you request a demo via the links in the result, section 8 applies.

8f. Orders via the order form

If you order a package via our order form, we process your name, position, email address and phone number, company, invoice address, VAT ID, a separate email address for invoices, your purchase order number, your notes, the ordered selection with the prices at the time of ordering, the language as well as your acceptance of the terms and conditions and your confirmation that you are ordering for a business (each with the time and the version of the terms), and, to prevent abuse, an encrypted value derived from your IP address (not the IP address itself). The data is stored in a database on servers in Germany.

Source of your order: if you reached us through a link that names a source, we store this source together with your order. Purpose, legal basis and your right to object are stated in section 8. We keep the source as long as the order (see the period below).

The purpose is to process your order, to conclude and perform the contract and to issue invoices. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual measures) and, for retention, Art. 6(1)(c) GDPR together with the retention duties under commercial and tax law. Before we process an order, we ask you to confirm your email address via a link. Unconfirmed orders are deleted automatically 30 days after submission. We keep orders and the proof of your acceptance of the terms and conditions as business records for the statutory period (usually six years, ten years for records relevant to invoices), even if your company later deletes its data in the customer area.

For orders from outside the European Union and where there are signs of a sanctions risk, we check the name of the company and, for small companies, the names of management and owners against public sanctions lists. The sources are your order, public registers and the sanctions lists themselves. The legal basis is Art. 6(1)(c) GDPR for the lists of the European Union (directly applicable prohibitions) and Art. 6(1)(f) GDPR for other lists and for persons in the company (our interest in not concluding prohibited business). We store the result with the order for the retention period under commercial law (Section 257 German Commercial Code).

To check a VAT ID you provided, our staff query the VAT Information Exchange System (VIES) of the European Commission to see whether the number is valid. We transmit only the country code and the number. We do not pass your data on to any other third parties.

8i. Applications

We accept applications by email. Which data we process for which purpose and on which legal basis, who receives it and how long we keep it is set out in the privacy notice for applicants on the page Careers.

8k. Maturity check

The maturity check at complass.eu/en/maturity-check evaluates your self-assessment exclusively in our server’s working memory to show you a result immediately. Your individual answers are not stored, not in a database, not in a file, not in your session and not in the server log files. For anonymous demand statistics we store after the evaluation only the frameworks chosen, the result level per framework (not the percentage), the topics of the biggest gaps, the language of the page, the day (without time of day) and the country the request came from. We do not store a state or canton for this tool. We determine the country on our own server from your IP address using a local database (DB-IP); the IP address is used only in working memory for this and is not stored. Only the sales team and management of Complass evaluate the statistics, in aggregated form; values below three are not shown. We use them to align our offer and our advertising with actual demand and do not pass them on to third parties or advertising networks. We delete individual entries after 13 months; after that only monthly totals per country and result remain. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offer according to demand). They are transmitted by POST and therefore do not appear in the address or in the server log files either. Only the preselection of a framework via a link from our pages appears in the address. The legal basis for the evaluation is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Your right to object: you can object to the processing for the demand statistics at any time under Art. 21 GDPR. This tool has no checkbox to opt out. An objection applies to future use, because we cannot attribute a stored entry to you.

Only if you explicitly click “Send result with demo request” in the result do we pass a short summary (frameworks, result levels and topics of the biggest gaps, no individual answers) to the enquiry form. It is only stored if you send the enquiry and additionally tick the separate, not pre-checked consent “Send the result of my maturity check with this request” there. The legal basis for this handover is your consent under Art. 6(1)(a) GDPR and, for the demo request itself, Art. 6(1)(b) GDPR (pre-contractual measures) as under section 8.

8j. Contacting us via WhatsApp

You can message us on WhatsApp Business at +49 211 5423 585-0. The service is provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When you write to us, we process your phone number, your profile display name, the content of your message, and the time and connection data, solely to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR for enquiries about our offer or a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is a quick and simple reply. We do not send advertising via WhatsApp and do not share any contacts from our address book with WhatsApp.

Message content is end-to-end encrypted between devices. WhatsApp Ireland processes connection and usage data (such as phone numbers, timestamps and device data) as an independent controller and may transfer it to Meta companies in the USA. According to WhatsApp, the transfer is based on the EU standard contractual clauses and, where certified, on the EU-US Data Privacy Framework adequacy decision. Details are in the WhatsApp privacy policy.

Please do not send confidential documents, evidence or credentials via WhatsApp; use email to info@complass.eu or our portal instead. We delete chats no later than 90 days after your enquiry is resolved unless statutory retention periods apply. Your rights (access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority) are described in section 10. Using WhatsApp is voluntary; you can also reach us by phone and email.

9. Customer area

Sign-up for the free trial: if you sign up for a trial, we process your company, your name, your email address and its domain, the selected package and your selection with country, whether you want demo data, the language, your confirmation that you act for a business, and, to prevent abuse, an encrypted value derived from your IP address (not the IP address itself). Before we create the access, you confirm your email address through a link. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual measures). We delete the sign-up 24 months after confirmation; until then it prevents a repeated free trial of the same company. Rejected sign-ups are deleted after 30 days, unconfirmed ones when the confirmation link expires.

Source of your trial: if you reached us through a link that names a source, we store this source together with your sign-up for the free trial. Purpose, legal basis and your right to object are stated in section 8. We delete the trial sign-up, and with it the source, 24 months after your confirmation.

To provide the customer area we process your user account data (name, email address, company, role, password as a secure hash, encrypted key for two-factor authentication) and a log of security-relevant events such as sign-ins and changes, with time and IP address. In confidential areas (incidents, data subject requests, vulnerability reports, evidence files) we also log who viewed or downloaded a record, with a reference to the record, never its content; if the same person opens the same record again within 15 minutes, no further entry is written. Viewing and downloading in the whistleblower system are recorded only in the case history, which only your company’s reporting office can see. The log is tamper-evident (later changes become visible) and secured off the server in encrypted form. People of your company with the right “Customer log” can see it; it is not evaluated to monitor performance or behaviour. Failed sign-in attempts are stored for 24 hours to protect against attacks. In the log we shorten IP addresses after 90 days and delete entries after 24 months or after the period chosen by your company (12 to 120 months). The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (security of the service). System messages such as invitations and reminders are sent by email.

Security log: to protect against attacks on sign-in we record security events, in particular failed sign-ins and codes, account lockouts, blocked connections, sign-ins from new devices and requests to typical attack targets. We store the time, the type of event, the user account and company concerned (if any), the sign-in address entered, the full and the shortened IP address, an encrypted identifier of the IP address, the approximate location derived from the IP address (country, region, city) as well as browser family and operating system. If the sign-in address entered does not belong to any account, we store it only in shortened form (the first three characters and the domain), because a password is occasionally typed into the name field by mistake. Passwords and codes are never stored. We determine the approximate location using a database stored locally on our server (DB-IP.com); the IP address is not transmitted to third parties for this purpose. To recognise new devices we store, per account and device, an identifier derived from browser family, operating system and network range and an encrypted value derived from the identifier in the device cookie (see section 6). The purpose is to detect and ward off attacks on sign-in, e.g. blocking attacking connections and evaluating where attacks come from and which accounts are affected. We shorten the full IP address after 30 days, remove the IP identifier after 90 days, delete the events including the approximate location after 90 days and known devices after 365 days without a sign-in. Your company’s administrators see the events on your company’s accounts, but not sign-in attempts with addresses that do not belong to any account. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the service, cf. Art. 32 GDPR).

So that we can notify you and the administrators of your company about a sign-in from a new country, we store for each user account the countries it has signed in from, with the time of the first and the last sign-in from there, but without the IP address. We delete a country from which there has been no sign-in for 365 days. Your company can switch this notice off. Complass staff only see the shortened IP address and the country derived from it for sign-in and security events of customer accounts, never the full IP address or the location; they need this information to detect attacks on sign-in and to answer questions about the account. The legal basis is Art. 6(1)(f) GDPR (security of the service).

Content that your company enters in the customer area (e.g. projects, evidence, tasks) is processed by us as a processor under Art. 28 GDPR on the basis of the contract concluded with your company.

Domain check: in the customer area you can have domains of your company and your suppliers checked. For this we query public sources: certificate logs via crt.sh, DNS records via the DNS4EU and Quad9 resolvers, and we call the home page of each host once via HTTPS. Only domain names are transmitted. The processing takes place on behalf of your company under Art. 28 GDPR.

Integrations: if your company sets up integrations, we transfer data to the extent set there. For integrations with your company’s systems (for example Slack, Jira, ServiceNow, Microsoft Azure or Amazon Web Services), these providers are recipients of your company; we access them only with the permissions your company has granted.

Complass assistant on the website: on our websites you can ask the AI assistant questions about Complass. The assistant opens only when you click it, and the conversation is kept when you change page. It sets no cookies. So that the conversation survives a change of page, your browser keeps the conversation (questions and answers) and whether the panel is open locally for the lifetime of the tab only (session storage); nothing further is transmitted from this storage, and it is deleted as soon as you close the tab or choose “Start over”. The legal basis for this is § 25(2) no. 2 TDDDG, because the storage is necessary for the conversation you started. When you ask a question, we send the question and the earlier questions of the conversation, together with matching sections of our public pages, to our processor Anthropic Ireland, Limited, which uses a language model to create an answer. Processing may take place in the USA; we base the transfer on EU standard contractual clauses. Anthropic does not use the data to train models and usually deletes it within 30 days; it may be kept longer in case of violations of the usage policy. Email addresses, phone numbers, IP addresses, IBANs and recognisable names are replaced by placeholders before sending; we do not recognise other personal data. Please therefore do not enter personal or confidential data. We use your IP address only as a daily changing hash to limit requests; it is deleted after 24 hours at the latest. We store the masked question for 30 days without any link to you, and we evaluate usage statistically to improve the assistant. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering questions about our offer). If the assistant cannot answer, it offers to pass your question to our team. Only if you agree do we store your email address, your name (optional), the question and the conversation, and we delete them once the request is closed, after 90 days at the latest; the legal basis is then Art. 6(1)(a) GDPR. You can withdraw your consent at any time. Answers are AI-generated and may contain errors; they are not legal advice.

Deletion on request: administrators of your company can first export all data under “Administration → Delete company and data” and then request the deletion of all company data (renewed sign-in with password and two-factor code, confirmation by email, waiting period of 7 days during which the deletion can be cancelled). We then delete all content, evidence files, user accounts and the company log and send a deletion confirmation. Excluded are invoices and accounting records, which we and, for online bookings, our payment provider Stripe keep within the statutory retention periods; for this purpose the subscription and billing address are kept without personal reference. Encrypted backups (on the server, as a copy outside the server in Germany and as a monthly offline copy) are deleted or overwritten after 60 days at the latest. The offline copy holds only the newest backup set, is kept encrypted on an external storage device held by our management and is replaced by the new set every month. Because every company has its own key in our backups, which we destroy with the deletion, your data are already unreadable in most backups at once; the backup of the security log follows its deletion period of 90 days. Tickets your company has already sent to us are kept without personal reference (anonymised). You can also request deletion at any time by emailing info@complass.eu.

9a. Partner portal and partners

Partner accounts: for persons who work for a partner of Complass and have an account in the partner portal, we process name, email address, role at the partner, sign-in and security data (for example the second factor) and a log of their actions. The purpose is to provide the partner portal and to perform the partner agreement. The legal basis is Art. 6(1)(b) GDPR towards the partner and, for the partner’s staff, our legitimate interest in a secure partner portal (Art. 6(1)(f) GDPR). When these persons work in a customer company, they do so through representative accounts of that customer; section 9 applies, and the customer company is the controller.

Information to the partner: if a customer company is assigned to a partner (partner code during the trial or when ordering, or the partner created the company account), we tell the partner the company name, the booked package, the contract status, the amounts paid and the commission on them. For sole traders this can be personal data. The legal basis is our legitimate interest in settling the commission and in support by the partner (Art. 6(1)(f) GDPR). We keep billing records for the periods required by commercial and tax law.

10. Your rights

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, as well as the right to rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with the competent supervisory authority.

The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR); you can object to processing for direct marketing without giving reasons (Art. 21(2) GDPR).

11. Contact for data protection enquiries

For questions regarding data protection, you can reach us at info@complass.eu.

We have not appointed a data protection officer, as there is no legal obligation to do so.