Privacy policy

1. Controller

Complass GmbH i. G.
Kölner Tor 31
40625 Düsseldorf
Represented by the managing director: Marc Linden
Phone: +49 (0) 176 723 355 81
Email: info@complass.eu

2. General information on data processing

As a general rule, we only process personal data to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with your consent or on the basis of Art. 6(1)(b) and (f) GDPR.

3. Hosting

This website and the customer area are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, on servers in Germany. Personal data collected here is stored on the host's servers. The host processes data exclusively for the stated purpose and in accordance with the GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

4. Server log files

The provider automatically collects and stores information in server log files, which your browser transmits automatically: browser type and version, operating system, referrer URL, hostname of the accessing computer, time of the server request and IP address. This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation).

5. Fonts and external content

The fonts Marcellus and Work Sans as well as all images and scripts are loaded locally from our own server. There is no connection to external providers such as Google Fonts or content delivery networks; your IP address is not transmitted to third parties when the page loads. The only exception is the visitor statistics on the public pages (section 7).

6. Cookies and local storage

We only use strictly necessary cookies. The session cookie contains a random identifier, protects forms against misuse (CSRF protection) and keeps you signed in to the customer area. It becomes invalid when you close your browser or sign out. If you choose a language yourself, your browser remembers this choice in a language cookie (only the language code, e.g. "en", valid for one year) so that the website and sign-in page appear in your language. After you sign in to the customer area, we set a device cookie. It contains a random, signed identifier and serves only to recognise your browser as a known device, so that we warn you by email only about sign-ins from new devices, even if your IP address changes (e.g. with iCloud Private Relay, a VPN or mobile networks). We store only an encrypted value derived from this identifier. The device cookie is valid for one year, is renewed with every sign-in and remains after you sign out. You can delete it in your browser at any time; your browser will then count as a new device the next time you sign in from a different network. When you open a link from one of our e-mails, your browser keeps its one-time key for a few seconds in a technically necessary cookie (at most 5 minutes), so the key does not stay in the address bar. If you close a notice bar on the home page about a pilot programme (cookie “cx_pilot_bar”) or about a promotion (cookie “cx_promo_bar”), your browser remembers this in a cookie so the bar does not appear again: for the pilot programme only the value “0”, for a promotion only the ID of the closed promotion. Both cookies are valid for one year, contain no personal identifier and are not passed on to third parties. Your choice between light and dark design is stored locally by your browser (local storage); this information is not transmitted to us. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

7. Visitor statistics (Plausible Analytics)

To understand how our public website is used, we use the analytics service Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Only the public pages of complass.de are measured, not the customer area, the sign-in or the forms. Signed-in users are not counted. Plausible does not use cookies, stores nothing on your device and does not create user profiles. When you visit a page, the page address (of its parameters, only the page and language identifiers and campaign identifiers such as utm_source are kept), the referring page (referrer), browser, operating system, device type, the language of the page and the country or region derived from the IP address are transmitted. The IP address itself is not stored: together with the browser identifier and a random value that changes daily, it is converted into an irreversible identifier that loses its reference after 24 hours. We also record anonymously whether a link to a demo, partner or other request or to the sign-in, an email or phone link, an external link or a download is clicked, and whether a request was submitted via the form (only the event and the kind of request, no form content). The data is processed exclusively on servers in the European Union and evaluated only in aggregated form. We have concluded a data processing agreement with Plausible pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in designing our website according to demand (Art. 6(1)(f) GDPR). You may object to this processing at any time (Art. 21 GDPR), e.g. by sending a message to info@complass.eu or by using a content or script blocker in your browser.

In the tour at complass.de/en/tour we count on our own server how often a chapter is started, storing only the chapter, language, day and count, without IP address, cookie, browser details or referring page. To protect against abuse we briefly process an encrypted value derived from your IP address (not the plain IP) for rate limiting, as for our forms.

Beyond this, we do not use any tracking or advertising services, nor any cookies for marketing or statistical purposes. There is no visitor statistics in the customer area.

8. Demo, partner and other requests

You can use the form on complass.de to request a demo, a partnership or a quote, or to send us another enquiry. Required are your name, company and email address; optionally you can provide your phone number (for a call back) and select what your request is about (e.g. NIS2, Cyber Resilience Act, ISO 27001, IEC 62443). If you come from the price configurator, we send your selection there along with it. The data is stored in a database on servers in Germany; a copy is sent to our mailbox for processing. To prevent abuse we additionally store an encrypted value derived from your IP address (not the plain IP). Requests sent via an earlier, more detailed version of the form may also contain position, message and further optional details.

After sending the form you can optionally “prepare the conversation”, each from predefined options: industry, company size (employees), occasion or deadline (e.g. planned audit, customer requires proof, NIS2, CRA, Machinery Regulation) and, for demo requests, the preferred time. This step can be skipped and is available for up to 48 hours after sending or confirming. We use these details to tailor the demo and our offer to your company and to organise requests internally; from them we derive an internal rough first assessment of which frameworks may apply to you. This assessment is not a legal review and not an automated decision within the meaning of Art. 22 GDPR. Without these details we process your request in the same way. Storage, legal basis and deletion as for the other form details.

The legal basis is your consent under Art. 6(1)(a) GDPR, and for demo, partner and other requests additionally Art. 6(1)(b) GDPR (pre-contractual measures). You confirm requests via a link in an email (double opt-in); unconfirmed requests are deleted automatically after 30 days. You can withdraw your consent at any time with effect for the future, e.g. by emailing info@complass.eu. We delete your data after withdrawal, but no later than twelve months after the last contact, unless a further business relationship arises.

In the past you could additionally join a waiting list. We now process these details only to inform you as promised, and delete them after the periods stated above.

8a. Applicability check

The applicability check at complass.de/betroffenheits-check evaluates your answers exclusively in our server’s working memory to show you a result immediately. Your answers are stored nowhere – not in a database, not in a file and not in your session – and are not logged. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Only if you explicitly click “Send result with demo request” in the result do we pass a short text summary calculated from your answers to the enquiry form. The summary itself contains no contact data; it only becomes part of your personal data once you send it together with your enquiry, and even then only if you additionally tick the separate, not pre-checked consent “Send the result of my applicability check with this request” there. The legal basis for this handover is your consent under Art. 6(1)(a) GDPR and, for the demo request itself, Art. 6(1)(b) GDPR (pre-contractual measures) as under section 8. Without this click and this checkbox, the check creates no stored data at all.

Because submitting the form (evaluating or sending the result) technically requires a session, doing so sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG; simply reading the page sets no cookie.

To protect against abuse we count requests per IP address (rate limiting, no plain-text log of the answers); the legal basis is Art. 6(1)(f) GDPR (security of the service).

8b. CRA reporting deadline calculator

The CRA reporting deadline calculator at complass.de/cra-meldefristen calculates the reporting deadlines from your inputs (type of report, point of awareness, time zone and, where applicable, further points in time) exclusively in our server’s working memory. Your inputs are stored nowhere – not in a database, not in a file and not in your session – and are not logged. They are transmitted by POST and therefore do not appear in the address or in the server log files either. The result is not passed to any other form. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Simply reading the page sets no cookie. As with the applicability check, submitting the calculation sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG. To protect against abuse we count requests per IP address (rate limiting, no log of the inputs); the legal basis is Art. 6(1)(f) GDPR (security of the service). If you request a demo via the links in the result, section 8 applies.

8c. AI risk class check

The AI risk class check at complass.de/en/ki-risiko-check classifies an AI system from your inputs (role, use cases and properties of the system) exclusively in our server’s working memory. Your inputs are stored nowhere – not in a database, not in a file and not in your session – and are not logged. They are transmitted by POST and therefore do not appear in the address or in the server log files either. The result is not passed to any other form. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Simply reading the page sets no cookie. As with the applicability check, submitting sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG. To protect against abuse we count requests per IP address (rate limiting, no log of the inputs); the legal basis is Art. 6(1)(f) GDPR (security of the service). If you request a demo via the links in the result, section 8 applies.

8d. Whitepapers

Via complass.de/whitepaper you can request whitepapers on individual frameworks (e.g. NIS2, Cyber Resilience Act) as a PDF. Your email address is required; name and company are optional. We store these details together with an encrypted value derived from your IP address (not the plain IP) in a database on servers in Germany and email you a download link (valid for 7 days, usable up to 5 times). The legal basis is Art. 6(1)(b) GDPR (fulfilling your request, a pre-contractual measure).

When submitting the form you can additionally and independently give two optional, not pre-ticked consents: (a) information by email about new and updated whitepapers, and (b) contact for a no-obligation conversation. Downloading the whitepaper does not depend on either consent. You confirm both via a separate link in the same email (double opt-in); without confirmation they do not take effect. The legal basis is your consent under Art. 6(1)(a) GDPR. If you confirm (b), we additionally copy your details into our lead management (see section 8) and a member of our team will contact you personally.

You can withdraw consent (a) at any time with effect for the future, via the unsubscribe link in every further email or by emailing info@complass.eu. Deletion periods: without confirmed consent we delete the request after 30 days; with confirmed consent (a) we delete it no later than 24 months after the last email to you; after withdrawal with no other active consent we delete it after a further 30 days. A confirmed contact request (b) follows the retention of our lead management (section 8). We do not pass your data on to third parties. Our visitor statistics (section 7) additionally apply to the use of these pages: we record anonymously that a whitepaper was requested and which one, without form contents or email address.

Direct sending at your request: if you ask a member of the Complass team in person for a whitepaper, for example in a conversation at a trade fair or by phone, we email it to you with a download link (valid for 7 days, usable up to 5 times). We store your email address, name and company (if given), the whitepaper and language, the occasion and date of the conversation, the sending team member and the number of downloads, and record the request in our lead management, expressly without consent to advertising. The email contains all privacy information and no advertising. The only recipient is our host Hetzner (section 3: hosting, mailbox and email delivery in Germany) as processor; there is no transfer to countries outside the EU. The legal basis is Art. 6(1)(b) GDPR, for requests on behalf of your company Art. 6(1)(f) GDPR; for the record Art. 6(1)(f) GDPR (documenting our business contacts and proving that it was sent). You can object at any time. We only send advertising or newsletters with your express consent. We delete the details 12 months after sending, or immediately after an objection.

Partner whitepaper: if we are talking with you or your company about a possible partnership, the sales team or management of Complass sends you our confidential partner whitepaper by email with a download link (valid for 7 days, usable up to 5 times) or as an attachment. Each copy carries the name of your company and a copy number. We store name, company and email address, the document, language and version, the copy number, the date and the sending team member, and the number of downloads, so that we can prove who received which confidential copy. This does not add you to our lead management, and it involves no advertising or newsletters. The only recipient is our host Hetzner (section 3) as processor; there is no transfer to countries outside the EU. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), for the record Art. 6(1)(f) GDPR (traceability of confidential documents). You can object at any time. We delete the issued file 30 days after the link expires and the record 12 months after sending, or immediately after an objection.

8e. Waiting list for individual packages (existing entries)

Until 10 October 2026 you could join a waiting list on our pages for industries and roles for a package that could not be booked yet. New sign-ups are no longer possible. We process existing entries only until they are deleted under the following rules. Stored are your email address, the company and name if you gave them, the selected package, the page you came from (industry or role), the language, the wording of your consent, the time and, to prevent abuse, an encrypted value derived from your IP address (not the plain IP). The data is stored in a database on servers in Germany.

The sole purpose is to notify you once by email as soon as the package can be booked. The legal basis is your consent under Art. 6(1)(a) GDPR. If you had not yet confirmed your sign-up via the link in our email (double opt-in), you can still do so within the period stated there; unconfirmed entries are deleted automatically 30 days after the sign-up. After the notification we delete your entry. If the package does not become bookable within 24 months of your confirmation, we delete it at that point at the latest.

You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every waiting-list email or by emailing info@complass.eu. Your entry is then deleted immediately. We do not pass your data on to third parties.

8f. Compliance cost calculator

The compliance cost calculator at complass.de/en/compliance-cost-calculator estimates the costs, internal effort and duration of an implementation from your inputs (framework, company size, scope, prior knowledge, sector and, where applicable, your own assumptions such as day rate, cost of a working hour and hours per week), exclusively in our server’s working memory. Your inputs are stored nowhere – not in a database, not in a file and not in your session – and are not logged. They are transmitted by POST and therefore do not appear in the address or in the server log files either. Only the preselection of a sector or framework via a link from our pages appears in the address. The result is not passed to any other form. If you download the result as a PDF, your inputs are transmitted again by POST and processed in working memory only to create the file; the PDF file is not stored on our side either. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing you with the tool you requested).

Simply reading the page sets no cookie. As with the applicability check, submitting the calculation sets a technically necessary session cookie, legal basis § 25(2) no. 2 TDDDG. To protect against abuse we count requests per IP address (rate limiting, no log of the inputs); the legal basis is Art. 6(1)(f) GDPR (security of the service). If you request a demo via the links in the result, section 8 applies.

8f. Orders via the order form

If you order a package via our order form, we process your name, position, email address and phone number, company, invoice address, VAT ID, a separate email address for invoices, your purchase order number, your notes, the ordered selection with the prices at the time of ordering, the language as well as your acceptance of the terms and conditions and your confirmation that you are ordering for a business (each with the time and the version of the terms), and, to prevent abuse, an encrypted value derived from your IP address (not the IP address itself). The data is stored in a database on servers in Germany.

The purpose is to process your order, to conclude and perform the contract and to issue invoices. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual measures) and, for retention, Art. 6(1)(c) GDPR together with the retention duties under commercial and tax law. Before we process an order, we ask you to confirm your email address via a link. Unconfirmed orders are deleted automatically 30 days after submission. We keep orders and the proof of your acceptance of the terms and conditions as business records for the statutory period (usually six years, ten years for records relevant to invoices), even if your company later deletes its data in the customer area.

To check a VAT ID you provided, our staff query the VAT Information Exchange System (VIES) of the European Commission to see whether the number is valid. We transmit only the country code and the number. We do not pass your data on to any other third parties.

9. Customer area

To provide the customer area we process your user account data (name, email address, company, role, password as a secure hash, encrypted key for two-factor authentication) and a log of security-relevant events such as sign-ins and changes, with time and IP address. In confidential areas (incidents, data subject requests, vulnerability reports, evidence files) we also log who viewed or downloaded a record, with a reference to the record, never its content; if the same person opens the same record again within 15 minutes, no further entry is written. Viewing and downloading in the whistleblower system are recorded only in the case history, which only your company’s reporting office can see. The log is protected against later changes (tamper-evident) and secured off the server in encrypted form. People of your company with the right “Customer log” can see it; it is not evaluated to monitor performance or behaviour. Failed sign-in attempts are stored for 24 hours to protect against attacks. In the log we shorten IP addresses after 90 days and delete entries after 24 months or after the period chosen by your company (12 to 120 months). The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (security of the service). System messages such as invitations and reminders are sent by email.

Security log: to protect against attacks on sign-in we record security events, in particular failed sign-ins and codes, account lockouts, blocked connections, sign-ins from new devices and requests to typical attack targets. We store the time, the type of event, the user account and company concerned (if any), the sign-in address entered, the full and the shortened IP address, an encrypted identifier of the IP address, the approximate location derived from the IP address (country, region, city) as well as browser family and operating system. If the sign-in address entered does not belong to any account, we store it only in shortened form (the first three characters and the domain), because a password is occasionally typed into the name field by mistake. Passwords and codes are never stored. We determine the approximate location using a database stored locally on our server (DB-IP.com); the IP address is not transmitted to third parties for this purpose. To recognise new devices we store, per account and device, an identifier derived from browser family, operating system and network range and an encrypted value derived from the identifier in the device cookie (see section 6). The purpose is to detect and ward off attacks on sign-in, e.g. blocking attacking connections and evaluating where attacks come from and which accounts are affected. We shorten the full IP address after 30 days, remove the IP identifier after 90 days, delete the events including the approximate location after 90 days and known devices after 365 days without a sign-in. Your company’s administrators see the events on your company’s accounts, but not sign-in attempts with addresses that do not belong to any account. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the service, cf. Art. 32 GDPR).

Content that your company enters in the customer area (e.g. projects, evidence, tasks) is processed by us as a processor under Art. 28 GDPR on the basis of the contract concluded with your company.

AI fill-in assistant: the AI fill-in assistant is switched off by default. Only owners and administrators of a company can switch it on; before that, Complass shows which data is sent where. If it is switched on and a person clicks "KI-Vorschlag" (AI suggestion) next to a text field, we send, for that field, the Complass help text, the linked legal texts and the saved text of the entry (for tasks title and description, for questionnaires also up to five matching approved answers from your answer library) to our sub-processor Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon Bedrock service), which uses a language model by Anthropic to create a suggested wording. When supplier answers are reviewed, the question and the supplier's answer are sent as well. Names of the people with access to your account, the name of the company and its sites, email addresses, phone numbers and IP addresses are replaced by placeholders before sending, also in your own supplier questions and your own evidence hints; we do not recognise names of other people in the text. Files and other records are not sent. Processing takes place in Amazon Web Services data centres in the EU. Amazon Web Services does not use the data to train models and does not store requests or suggestions; the provider of the language model gets no access. Amazon Web Services is a subsidiary of a company based in the USA; processing in the EU does not completely rule out disclosure requests by US authorities. We store the suggestion, the sources named and the person's decision (accepted, edited, discarded) for 12 months, the request itself only as a checksum; only owners and administrators of your company can see them, not our staff. If a suggestion is saved, we note at the field that the text was worded with AI assistance (model, time, person, checksum of the text, no text); this note remains as long as the record exists and the text is not changed by hand; it is not carried over when a customer package is restored. A suggestion is never applied automatically; a person always decides. We process this data as your company's processor under Art. 28 GDPR; Amazon Web Services is listed among the sub-processors in our data processing agreement.

Deletion on request: administrators of your company can first export all data under “Administration → Delete company and data” and then request the deletion of all company data (renewed sign-in with password and two-factor code, confirmation by email, waiting period of 7 days during which the deletion can be cancelled). We then delete all content, evidence files, user accounts and the company log and send a deletion confirmation. Excluded are invoices and accounting records, which we and our payment provider Stripe keep within the statutory retention periods; for this purpose the subscription and billing address are kept without personal reference. Encrypted backups (on the server, as a copy outside the server in Germany and as a monthly offline copy) are deleted or overwritten after 60 days at the latest. Because every company has its own key in our backups, which we destroy with the deletion, your data are already unreadable in most backups at once; the backup of the security log follows its deletion period of 90 days. Tickets your company has already sent to us are kept without personal reference (anonymised). You can also request deletion at any time by emailing info@complass.eu.

10. Your rights

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, as well as the right to rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with the competent supervisory authority.

The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR); you can object to processing for direct marketing without giving reasons (Art. 21(2) GDPR).

11. Contact for data protection enquiries

For questions regarding data protection, you can reach us at info@complass.eu.

We have not appointed a data protection officer, as there is no legal obligation to do so.