Privacy Policy

1. Who we are

GDPR ("we", "us", "our") is a GDPR compliance register operated by [Legal Company Name], registered in [Country/Region] under company number [Registration Number]. Our registered address is [Full Address]. For privacy queries, contact [privacy@yourdomain.com].

2. What we collect

When you create an account and use the service, we collect:

• Account information: name, email address, password (stored hashed, never in plain text).
• Company information: company name, industry, and any data your team enters into the compliance registers (subject access requests, breach records, DPIAs, supplier records, processing activity records, training rosters).
• Billing information: handled by our payment processor, Stripe — we do not store full card numbers ourselves. See Stripe's own privacy policy for details of what they process.
• Usage data: standard server logs (IP address, browser type, pages visited) for security and troubleshooting.

3. Why we collect it, and our legal basis

We process this data to provide the service you've signed up for (contractual necessity), to bill you for your subscription (contractual necessity), to respond to support requests (legitimate interest), and to comply with our own legal obligations (legal obligation). Where we rely on consent — for example, optional marketing communications — you can withdraw it at any time.

4. Who we share it with

We share data with the following categories of processor, only as needed to run the service:

• Stripe — payment processing.
• [Your email provider] — transactional email (deadline reminders, invitations, password resets).
• [Your hosting provider] — infrastructure hosting the application and database.

We do not sell personal data to third parties.

5. How long we keep it

Account and company data is retained for as long as your account is active, plus [X months/years] after closure for legal and accounting purposes. You can request earlier deletion — see Section 7.

6. Cookies

We use essential cookies required for you to stay logged in and for basic security (CSRF protection). We do not currently use tracking or advertising cookies. [Update this section if you add analytics or marketing cookies.]

7. Your rights

Under GDPR, you have the right to access, correct, delete, restrict, or export your personal data, and to object to certain processing. To exercise any of these rights, contact [privacy@yourdomain.com]. You also have the right to complain to your local data protection authority.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or an in-app notice before they take effect.