Privacy Policy

Last updated: 18 October 2026

This policy informs you, pursuant to Art. 13 and Art. 14 GDPR, which personal data we process when you visit this website, when you send us an enquiry, when you place an order online and when we handle an order, on what legal basis this takes place and which rights you have. It relates exclusively to our own processing activities and does not constitute legal advice.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG):

2. Data protection officer

We have not appointed a data protection officer. For any questions regarding data protection, please contact the controller directly: office@compliance-kit.eu.

3. Visiting the website (server log files)

This website is a static website; it is hosted on Cloudflare Pages and delivered via the Cloudflare content delivery network. When you call up a page, your browser transmits technically necessary data which are processed in server log files:

• IP address of the requesting device
• date and time of access
• name and path of the file retrieved
• referrer URL, where transmitted
• browser and operating system used

The purpose is the delivery of the website, operational and functional security, and the prevention of attacks and misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning web presence).

Log data are stored only for as long as is necessary for these purposes and are deleted thereafter. These data are not merged with other data sources and are not evaluated for advertising purposes.

The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH. Cloudflare acts for us as a processor pursuant to Art. 28 GDPR; a data processing agreement is in place. For transfers to third countries, see section 10.

4. Contact form and e-mail contact

You can use the contact form to ask us questions or to request a custom quote, for example about a kit or an e-learning course. Technically, the process is set up as follows:

• The form is received by a Cloudflare Pages Function (Cloudflare, Inc., see section 3).
• The Function passes the enquiry to the e-mail delivery provider Resend, Inc., USA, which delivers the message as an e-mail.
• The recipient is our mailbox office@compliance-kit.eu, which is operated on Google Workspace (Google Ireland Limited, Ireland).

We process the data you provide in the form: company and e-mail address (mandatory), your name (optional), the type of enquiry, the kit or e-learning course selected, the jurisdiction, the number of participants (optional) and your message. Company and e-mail address are required so that we can answer your enquiry; without them the enquiry is not sent. In addition, technical transmission data such as the IP address and the time of submission are processed, as well as the language and the page from which you sent the form. If you contact us by e-mail, we process the details contained in your e-mail.

The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at concluding a contract or serves the performance of pre-contractual measures, and Art. 6(1)(f) GDPR for all other enquiries (legitimate interest in responding to communications addressed to us).

Resend, Inc. and Google Ireland Limited act for us as processors pursuant to Art. 28 GDPR. For transfers to third countries, see section 10.

Retention period: Enquiries are deleted once they have been dealt with conclusively and no retention obligations prevent deletion. If the enquiry leads to a contract, the statutory retention periods apply (see section 6).

5. Bot protection (Cloudflare Turnstile)

To protect the contact form against automated submissions (spam, misuse), we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. Turnstile checks whether the submission originates from a human being and processes browser and connection data for this purpose, in particular the IP address and information about the browser and end device used.

The Turnstile script is loaded from Cloudflare as soon as you open the contact page. When you submit the form, our Pages Function transmits the Turnstile token together with your IP address to Cloudflare for verification; Cloudflare returns the verification result. We do not store the verification result.

Turnstile is strictly necessary for the operation of the form; no analytics or marketing cookies are set and no cross-site tracking takes place. The associated access to your end device is permitted without consent under § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) or § 25(2) no. 2 of the German Telecommunications-Digital-Services Data Protection Act (TDDDG), because it is strictly necessary in order to provide the service you have expressly requested. The legal basis for the processing is Art. 6(1)(f) GDPR (legitimate interest in preventing misuse).

6. Online ordering and payment processing

Kits and e-learning courses can be ordered and paid for online; the offer is directed exclusively at businesses. In the ordering process, we process the following order data:

• company name
• first and last name of the contact person
• e-mail address
• billing address (for payment via Stripe)
• VAT identification number (VAT ID; B2B, inter alia for assessing the reverse-charge mechanism)
• product ordered (kit with package or e-learning course, jurisdiction version) and invoice amount

Company, contact person, e-mail address and VAT ID, as well as your confirmation that you are ordering as a business and your acceptance of the terms and conditions, are required to conclude the contract; without these details we cannot accept the order. If you have no VAT ID, you can send us an enquiry via the contact form (section 4).

For payment by card or SEPA direct debit, the payment service provider Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) processes the payment (ordering process via Stripe Checkout). The details from the order form are first received by a Cloudflare Pages Function (Cloudflare, Inc., see section 3), which transmits the following to Stripe: product, package or number of participants, jurisdiction version, language, company, contact person, e-mail address, VAT ID and, where provided, your notes on personalisation. You enter your billing address and payment data directly on the Stripe payment page; you can also state your VAT ID there. Stripe creates a customer record for this purpose and generates the invoice. We do not receive complete payment data, but are informed by Stripe of the receipt of payment. Stripe's privacy policy applies to the processing by Stripe: stripe.com/privacy.

If you choose payment by bank transfer against invoice, Stripe does not receive any data. The Cloudflare Pages Function passes your order data (product, package or number of participants, jurisdiction version, amount, company, contact person, e-mail address, VAT ID, where provided your notes on personalisation, your confirmation that you are ordering as a business, your acceptance of the terms and conditions and the time of the order) to the e-mail delivery provider Resend, Inc., which delivers them to our mailbox office@compliance-kit.eu (Google Workspace) and sends you an order confirmation to the e-mail address you provided. We issue the invoice ourselves and send it to you by e-mail.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures) and Art. 6(1)(c) GDPR (compliance with legal obligations, in particular retention obligations under commercial and tax law).

Retention period: Invoices, records and the associated contract data are retained in accordance with the statutory retention obligations, which in Austria amount to seven years from the end of the calendar year concerned and beyond that for as long as they are relevant to pending tax, court or administrative proceedings (§ 132(1) of the Austrian Federal Fiscal Code (BAO) and, where applicable, § 212(1) and (2) of the Austrian Commercial Code (UGB)). Apart from Stripe and the service providers listed in section 10, we disclose order data only where we are legally obliged to do so, for example to the tax authorities.

7. Delivery of the kits and e-learning courses

Following receipt of payment, kits and e-learning courses are provided by e-mail or via a download link. We provide the download link within 48 hours of receipt of payment; the period is counted on working days. A customer account is not required for this; no registration takes place. We process the e-mail address and the order data required to allocate and deliver the order and, for personalising the files, the company name, the licence ID assigned and, where you send it to us, your logo. The legal basis is Art. 6(1)(b) GDPR. To protect our rights of use, we also mark the files with licence and origin markings (including the licence ID, a marking in the footer and in the file metadata) and keep a register of which licence ID has been assigned to which customer. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is to be able to detect unauthorised disclosure of the files and attribute it to the licensee.

8. E-learning courses (delivered as files)

The e-learning courses are delivered as files: as a standalone HTML file or as a SCORM package (SCORM 1.2/2004) for the customer's own learning management system (LMS). We do not operate an e-learning platform and do not host the courses.

Participant data, such as learning progress, test results and certificates of participation, are processed exclusively by the customer in its own learning system or IT environment; they remain with the customer and are not transmitted to us. No participant data are collected via this website.

9. Cookies and access to your end device

We do not use analytics, statistics or marketing cookies and we do not integrate any tracking services. Neither reach measurement nor profiling takes place. A cookie banner is therefore not required.

Access to your end device is limited to technically necessary operations, in particular the bot protection of the contact form (section 5). Such access is permitted without consent under § 165(3) TKG 2021 and — in so far as German law applies — under § 25(2) no. 2 TDDDG.

The Stripe payment page used in the ordering process (section 6) is subject to Stripe's own privacy and cookie information.

Fonts and other design elements are delivered locally from our server. Google Fonts and comparable external resources are not integrated. We do not send a newsletter.

Our freely accessible knowledge tools and self-assessments run entirely locally in your browser. Your entries and results are not transmitted to us and are not stored; no sign-in is required.

No automated decision-making, including profiling, takes place.

10. Recipients and transfers to third countries

Personal data are received by the following service providers, which act for us as processors pursuant to Art. 28 GDPR:

• Cloudflare, Inc. (USA; in the EU: Cloudflare Germany GmbH) — hosting of the static website (Cloudflare Pages), CDN, DNS, DDoS protection, Pages Functions for the contact and order forms and for the download links, Turnstile bot protection
• Resend, Inc. (USA) — delivery of contact enquiries and orders against invoice to our mailbox and of order confirmations to you as e-mail
• Google Ireland Limited (Ireland) — operation of our mailbox office@compliance-kit.eu (Google Workspace)

With Cloudflare and Resend, and when using Google Workspace, processing may take place in the United States of America and thus involve a transfer to a third country within the meaning of Art. 44 et seq. GDPR.

These transfers take place on the basis of standard contractual clauses (Art. 46(2)(c) GDPR) and, where certified, the EU-US Data Privacy Framework. You can obtain a copy of the standard contractual clauses on request at office@compliance-kit.eu. They are supplemented by the contractual obligations set out in the respective data processing agreements. Despite these safeguards, access to data by authorities in the third country cannot be entirely ruled out; you can control the scope of the data transmitted by contacting us directly by e-mail or by post instead of using the form.

For online orders, the payment service provider Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) additionally receives the data required for payment processing (section 6). Stripe's privacy policy applies to the processing by Stripe, including any transfers to third countries (stripe.com/privacy).

Data are not passed on to any other recipients unless we are legally obliged to do so.

11. Your rights

With regard to the personal data concerning you, you have the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until withdrawal remains unaffected

Please address your request informally to office@compliance-kit.eu. As a rule, we answer requests within one month of receipt; in the case of complex requests, this period may be extended by a further two months under Art. 12(3) GDPR, of which we will inform you.

Right to object: Where we process your data on the basis of Art. 6(1)(f) GDPR (sections 3, 4, 5 and 7), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

12. Right to lodge a complaint with the supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is:

13. Data security

Transmission between your browser and our website is encrypted using TLS (HTTPS). Access to personal data is limited to persons who require it in order to perform their tasks. Our service providers are contractually obliged to apply appropriate technical and organisational measures.

14. Currency of this privacy policy

This privacy policy is dated 18 October 2026. If our processing activities or the services we use change, we will amend this policy and update the date shown.