PROCESSING, PERSONAL DATA, AND DATA SUBJECTS
1. Types of personal data and how we process it
This privacy statement applies to any processing of personal data on Complai.com and the Complai online service which is hereinafter referred to as the “Website and service”.
Personal data in this regard shall mean any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
Processing shall mean any operation which is performed on personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Registration for and use of our services and products
We will process personal data actively provided by you, e.g. when you register with us by setting-up an account on Complai, sending us requests or questions, prepare offers or place orders or access services. Such personal data may contain inter alia your name, e-mail address, contact details, company affiliation, request, and order information.
Complai collects and uses personal data only to provide you with the services you requested, to administer your account, identify you at sign-in and to communicate with you. We also interact with you via our general enquiry/support sections or responding to complaints or general feedbacks given by you on our services or because we had or have a contract with you in place.
We may also contact you with regards to your satisfaction with our products and services and may conduct other surveys.The legal basis for the processing is GDPR article 6 (1) (b) and (f) (necessary for the performance of our obligations towards you and for us to administer our relationship with you).
We use the personal data and contact data you provide by registration to inform you directly about our additional products and services. The use of your personal data for directly advertising related products and services is a legitimate interest for us as a provider of this Software.
You can object to the use of your personal data for direct marketing at any time. We will then refrain from any processing to the extent it is related to such purposes. You can inform us about your objection under contact, contact@complai.com
We process your personal data as far as necessary for compliance with legal obligations to which we as the data controller are subject, the applicable commercial accounting obligations and tax law requirements.
Your personal data is, in the absence of exceptions within the specific services mentioned below, retained for as long as your user account is used. After deletion of your account, your personal data will be erased once the purpose for keeping it has expired. Some personal data may be kept for security related purposes. Statutory storage obligations or the need for legal actions that may arise from misconduct within the services or payment problems can lead to a longer retention of your personal data. In this case, we will inform you accordingly.
Usage Reports
We will provide our customers with usage reports to inform them how data is captured, accessed, and processed. To do so, we will track the activity on an account, e.g. date and time of access.
Log files
Complai is collecting log files when using the service to determine error situations.
Informational e-mails
With your email address you can subscribe to our informational e-mails that provide you with the latest news about our products and services like webinars, analytics, reports, and whitepapers if you consent to receiving such e-mails. Your email address will be retained as long as you subscribe to our informational e-mails.
This service is provided by means of a double-opt-in. Thus, you will receive an email containing a link by which you can confirm that you are the owner of the email address and wish to be notified via our email service. If your subscription is not confirmed, we will not send you informational e-mails.
You can unsubscribe from this service by opting out via the link provided in each informational e-mail.
Forms on our website
When you request a demo, contact us, sign up for the pre-flight check or send us a support request through a form on our website, we process the data you enter: your name, business e-mail address and company, and – depending on the form – the segment that describes you, the standard you are interested in, the subject and content of your request and any message you add. We also record the page from which you sent the form and the time of submission.
We use this data to respond to your request, to arrange the demo or set up the pre-flight check, and to handle your support request. The legal basis is your consent, which you give by ticking the consent box in the form (GDPR article 6 (1) (a)), and, where your request concerns an existing or intended contract with us, GDPR article 6 (1) (b). You can withdraw your consent at any time with effect for the future by contacting us at contact@complai.com.
If you also tick the box to receive other communications from ComplAi, we will first send you an e-mail asking you to confirm your subscription (double opt-in). Once you have confirmed, we use your e-mail address to send you information about our products and services until you unsubscribe (see Informational e-mails above).
The forms are processed by HubSpot on our behalf (see section 3). We keep the data for as long as we need it to handle your request and any business relationship that follows, unless statutory retention obligations apply.
Automated decision making
We do not use your personal data for automated decision making which produces legal effects concerning you or similarly significantly affects you.
2. Duration of the processing
We strive to keep our processing activities with respect to your personal data as limited as possible. In the absence of specific retention periods set out in this policy, your personal data will be retained only for as long as we need it to fulfil the purpose for which we have collected it and, if applicable, as long as required by statutory retention requirements.
3. Recipients
Complai internal recipient
Data will only be available within the COMPLAI company to support the operation of the application.
Third party recipients
We engage third party companies and individuals who assist us in providing the services and products we offer through this Application or support us with certain functions related to this Application. Your personal data will be e. g. shared with the following third parties and partly their sub-processors based also outside EU/EEA:
• Microsoft Corporation (cloud hosting of the application and the website, Microsoft 365)
• Auth0® Inc. (sign-in to the application)
• HubSpot, Inc. (customer relationship management, website forms)
• Zoho Corporation (Zoho Desk, customer support)
• Twilio Inc. (SendGrid, sending of e-mails)
• Tripletex AS (accounting)
• Google LLC (YouTube videos in the application’s help content, see section 6)
• Sanity AS and Mux, Inc. (help content and videos in the application, see section 6)
Moreover, when you purchase a service on Complai from any Service Provider we share the following basic set of personal data (e.g. username, name, company affiliation, email, service subscription, login ID) for the purpose of enabling the service provider to verify that you are registered as a user of Complai and to allow you to experience the usage of Complai in a more convenient way. We require these Service Providers to comply with relevant personal data protection laws.
Our Service Providers will only use your personal data to the extent necessary to perform their functions and will be contractually bound to process your personal data only on our behalf and in compliance with the requests.
We may disclose your personal data if legally entitled or required to do so (for example if required by law or by court order). The legal basis for this processing is Art. 6 (1) 1 lit. c GDPR.
Microsoft Cloud Services
Complai relies on the services of a reputable provider of cloud services for the purpose of the Complai services provided by Microsoft™. Access to and use of this service is governed by the terms of Microsoft as applicable from time to time, including its risk distribution.
Microsoft may process some of your data for its own purposes in its capacity as data controller to comply with legal obligations and requirements. This data processing falls within the sole responsibility of Microsoft. The Microsoft Privacy Statement explains the personal data Microsoft processes, how Microsoft processes it, and for what purposes.
HubSpot
We use HubSpot, a customer relationship management platform provided by HubSpot, Inc. (USA) and its affiliates, to receive and manage the requests you send us through the forms on our website. HubSpot processes this data on our behalf under a data processing agreement. Your data may be transferred to the USA; such transfers are subject to the safeguards described under International data transfer below.
International data transfer
Within the scope of our information sharing activities set out above, your personal data may be transferred to other countries (including countries outside the European Union) which may have different data protection standards than your country of residence. Please note that data processed in a foreign country may be subject to foreign laws and accessible to foreign governments, courts, law enforcement, and regulatory agenciesAll transfers of your personal data outside the EU / EEA will be subject to transfer mechanisms in accordance with the GDPR, typically by the adoption of EU’s Standard Contractual Clauses.
4. Retention periods
We strive to keep our processing activities with respect to your personal data as limited as possible. In the absence of specific retention periods set out in this policy, your personal data will be retained only for as long as we need it to fulfill the purpose for which we have collected it and, if applicable, as long as required by statutory retention requirements.
5. Security
We are committed to maintaining the confidentiality, integrity, and security of your personal data and take precautions to protect such information. It is our policy to use reasonable and appropriate administrative, technical, and physical safeguards designed to protect the personal data we have about you from loss, theft, and unauthorized use, access, modification, or destruction. We periodically review our policies and procedures to confirm that they are appropriate to meet our commitment to our community, our customers, and ourselves.
We also require third-party service providers acting on our behalf or with whom we share your personal data to maintain security measures consistent with applicable regulatory compliance requirements.
Notwithstanding our security safeguards, it is impossible to guarantee absolute security in all situations. If you have any questions about the security of our Site or Services, please contact us at contact@complai.com. For your own security, please do not send any confidential or sensitive personal data to us via email or through the contact form on our website.
6. Cookies and similar technologies
Cookies are small text files stored in your browser. Similar technologies such as the browser’s local storage work in a comparable way. Under data protection law, we may only store information on your device, or read it, without your consent where this is strictly necessary to provide the service you have requested.
Our website
Our website complai.com does not use cookies or similar technologies, and it does not use analytics or advertising tools. It loads no content from third parties. When you send us a form, the data you enter is transmitted to HubSpot (see section 1, Forms on our website, and section 3); no cookie is set in the process. Our trust center is operated by Secfix and opens on Secfix’s own website; Secfix’s privacy notice applies there.
Our application
When you use the ComplAi application, we use only technologies that are strictly necessary to provide it:
• a session cookie (complai.web-auth0.sid) that keeps you signed in. It is deleted when you close your browser; the session it refers to is stored on our servers and expires after one day at the latest.
• cookies set by our sign-in service Auth0 on login.complai.com, which are needed to sign you in securely.
• entries in your browser’s local and session storage that remember your settings in the application — for example column widths, display modes, saved filters and whether you have hidden the help carousel — and a random browser identifier that keeps several open tabs in sync. These entries stay on your device; you can delete them at any time in your browser settings.
The legal basis is that these technologies are strictly necessary for the service you have requested (Art. 5 (3) of Directive 2002/58/EC and the national laws implementing it) and, for the processing of personal data, GDPR article 6 (1) (b).
Help content in the application includes videos provided through Mux and, where embedded, YouTube (in privacy-enhanced mode). When you play such a video, your IP address is transmitted to the provider.
The application does not use analytics or advertising cookies.
7. Your choices and rights
Opt-out of marketing email communications You can opt-out of direct marketing from ComplAi at any time by checking and updating your contact details within your account, using the “unsubscribe” link at the end of all our marketing emails. If you are a customer and you opt-out of receiving marketing messages from Complai, you may continue to receive transactional communications from us regarding our Services.
Cookies and similar technologies See section 6: our website uses none, and the application uses only those strictly necessary to provide it. You can delete cookies and local storage at any time in your browser settings.
Mobile Device Settings Your mobile device may also have settings that, if enabled, restrict mobile app platforms (such as Apple and Google) from sharing certain information obtained by automated means.
Data subjects’ rights
You may be entitled to exercise some or all of the following rights free of charge:
a. require (i) information on whether your personal data is retained and (ii) access to and/or (iii) duplicates of your personal data retained, including the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed and where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
b. request proper rectification, removal or restriction of your personal data, e.g. because (i) of the incomplete or inaccurate nature of the personal data, (ii) it is no longer needed for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have taken advantage of an existing right to object to the data processing; in case your personal data is processed by third parties, we will forward your request for rectification, removal or restriction also to such third parties unless this proves impossible or involves disproportionate effort;
c. receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from our side; where technically feasible you shall have the right to have the personal data transmitted directly from us to another controller,
d. refuse to provide and – without impact to data processing activities that have taken place before such withdrawal – withdraw your consent to processing of your personal data at any time;
e. object at any time that your personal data will be used for direct marketing purposes, or – based on grounds relating to your particular situation, that your personal data shall be subject to data processing for other purposes;
f. not to be subject to any automatic individual decisions (automatic decisions based on data processing by automatic means, for the purpose of assessing several personal aspects) which produce legal effects on you or similarly significantly affect you;
g. take legal actions in relation to any breach of your rights regarding the processing of your personal data, as well as to lodge complaints before the competent data protection regulators.
8. Revision of the statement
We reserve the right to adjust and adapt this privacy statement, for example in the event of changed regulatory requirements. Our updated privacy statement at any time will be published on our website complai.com.
9. Contact details
The Data Controller is Complai AS, Norwegian business nr.925 076 767 . If you have any questions regarding our processing of personal data please contact us: contact@complai.com