The Compliance Desk is the data controller for the personal data described in this Policy. Full legal-entity details are set out in the Legal Notice section of our Terms of Service.
Through checkout (Stripe): name, email address, billing address, and, where provided for reverse-charge purposes, business name and VAT identification number. We do not receive or store full payment card numbers; these are handled directly by Stripe as an independent processor.
Through use of Archon: submitted queries and standard usage metadata (timestamps, query volume), retained for service reliability, security, and abuse prevention. Customer queries are not used to train models made available to other customers.
Through our websites: standard technical logs (IP address, browser type) and any information voluntarily submitted through contact or waitlist forms.
We process personal data on the following bases under the General Data Protection Regulation (EU) 2016/679: performance of a contract, in order to provide and bill for the Services; legitimate interest, in order to maintain security and improve the Services; and legal obligation, in order to satisfy Austrian tax and accounting record-keeping requirements.
Data is used to deliver and bill for the Services, respond to support inquiries, and issue service-related communications. Marketing communications are sent only with your separate, affirmative consent.
We disclose data to Stripe, Inc. and its affiliates for payment processing, acting as an independent controller/processor under its own privacy policy. We do not sell personal data to third parties. Where the Services are accessed through a White-Label partner, that partner's own privacy policy governs their independent processing of your data.
Billing and tax-relevant records are retained for the period mandated under Austrian law, generally seven (7) years. Usage logs are retained for a shorter operational period not generally exceeding twelve (12) months, absent a specific legal or dispute-related requirement to retain them longer.
Under the GDPR, you are entitled to: access the personal data we hold concerning you; request rectification of inaccurate data; request erasure, subject to our legal retention obligations; receive your data in a portable format; object to processing conducted on the basis of legitimate interest; and lodge a complaint with the Austrian Datenschutzbehörde (dsb.gv.at) or the supervisory authority of your own member state. Requests may be directed to the contact address below.
Stripe may process data outside the European Economic Area as part of its global payment infrastructure, subject to its own GDPR-compliant safeguards, including Standard Contractual Clauses. The Compliance Desk does not otherwise transfer personal data outside the EEA in the ordinary operation of the Services.
[To be completed to reflect the actual configuration of your websites — specify any analytics or advertising cookies in use, or state plainly that none are used beyond essential technical cookies.]
This Policy may be amended from time to time. Material changes will be communicated to active subscribers.
contact@thecompliancedesk.eu