Privacy policy

TODO counsel: placeholder text. This page must be reviewed and completed by legal counsel before launch.

1. Controller

Vyonica (operator of compliance.vyonica.com). Contact details are listed in the imprint.

2. What we process

Account data: name, e-mail address, organisation, role, language preference.
Content you upload: AI system descriptions, documents, evidence files and their hashes.
Technical data: server logs (IP address, user agent, timestamps) kept for 30 days for security.
Analytics: cookieless, aggregated page statistics (Plausible, EU-hosted) when enabled. No cookies, no cross-site tracking.

3. Purposes and legal bases

Contract performance (Art. 6(1)(b) GDPR) for the service itself; legitimate interest (Art. 6(1)(f) GDPR) for security logging and aggregated statistics; consent (Art. 6(1)(a) GDPR) where we ask for it explicitly.

4. Processors and hosting

Data is hosted in the European Union. Processors are listed in the data processing agreement.

5. Retention

Account data for the life of the account plus the statutory retention periods; uploaded content until you delete it or the organisation is closed; logs 30 days.

6. Your rights

Access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority. Write to the address in the imprint.

7. No automated decision-making

The platform proposes classifications and drafts; roles and risk classes are always set by a person in your organisation.