×
Privacy Policy
Protecting your personal data matters to us. This policy informs you in accordance with the GDPR about the nature, scope and purpose of the processing of personal data on this website.
Controller
Patrick de Kathen
10 Xagħra Heights
Xagħra, Gozo
Malta (EU)
kontakt@klarcomply.com
Data collected when visiting the site
When you access the website, technically necessary data (e.g. IP address, time, page requested) is processed by the hosting provider (Cloudflare) to ensure delivery and security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest).
Quick check, compliance kit and enquiry forms
Quick check and tools: the quick check runs entirely in your browser. Your answers and your result are not transmitted to us; you can save the result as a PDF or print it yourself. The same applies to the policy generator and the other tools on this website, such as the AI label: your entries stay in your browser, and we do not ask for an email address there. How we count the use of the quick check anonymously is described in the section on the services we use. Compliance kit: you receive the download without providing any personal data. Enquiries for more than 100 seats and about strategic partnerships: we process the details from the form (name, company or organisation, email address, preferred option, number of seats, time frame, your message and the page from which you sent the form) in order to answer your enquiry and make you an offer. The legal basis is Art. 6(1)(b) GDPR; if you enquire on behalf of a company or organisation, Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries and initiating business relationships). If you arrived via a sales partner's link and a partner code is stored in your browser (see the section on storage in your browser), we note that code on your enquiry; the partner only sees a count, not your details. If you email us, we process your message and your contact details in order to reply (Art. 6(1)(b) or (f) GDPR). Required fields are marked; without them we cannot process your enquiry. There is no automated decision within the meaning of Art. 22 GDPR. We do not pass your details on to third parties for their advertising purposes; those who process them on our behalf are listed in the section on the services we use.
Account, training and certificate
For the company dashboard and the training we process sign-in data (email address), the names of the participants, their progress and their test result. The legal basis is Art. 6(1)(b) GDPR: without this information neither an account nor a certificate can be issued. Where the participants are employees of a corporate customer, we process this data on that employer’s behalf; see the section on processing on behalf of our customers.
Publicly verifiable certificates
Every certificate carries a verification ID. Anyone who knows that ID can look up the name of the certified person, the company and the expiry date at klarcomply.com/verify. That is precisely what a certificate is for and part of the agreed service (Art. 6(1)(b) GDPR). Without the ID there is no lookup, and there is no list of all certificates. Issued certificates stay verifiable until they expire, including after the contract ends.
Emails from us
We only send you emails that you have requested yourself or that belong to your contract: replies to your enquiries, sign-in links, purchase and payment confirmations, notices about your access and your training, for business customers the legal updates and certificate expiry notices included in the subscription, and for partners the messages about the partnership, including legal updates. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for contact persons at companies. We do not send newsletters or advertising emails. We keep a log of every automatically sent email (recipient, type of email, time) so that no message arrives twice. We delete it after three years; entries on one-off messages to customers and partners are kept for as long as the business relationship exists and deleted once it ends. Individually written emails that we send through this system are deleted there twelve months after sending. Anyone who asks us not to send any more emails is placed on a suppression list; we keep this entry for as long as we send emails (Art. 6(1)(f) GDPR). We measure neither opens nor clicks.
Storage in your browser
We set no cookies. In your browser’s storage (localStorage) we keep only the following entries. First, what is strictly necessary for a function you have requested (Art. 5(3) of Directive 2002/58/EC, Section 25(2) no. 2 TDDDG): the language you chose (kc_lang, until you delete the site data); once you are signed in, your session (sb-*-auth-token, until you sign out); in the course, your progress and the course you chose (kc_kurs_*, kc_track, until you delete the site data); in the partner dashboard, which cards you have expanded or collapsed and which setup steps are done (kc_karte_*, kc_ob_*, until you delete the site data); during partner registration, your entries and, where applicable, the code of the partner who invited you (kc_partner_reg, until registration is complete; after seven days we no longer use these details and delete the entry the next time it is read, for example when you open the registration page again). Second, if you arrive via a referral or partner link (an address with ?ref= or ?partner= or a short link klarcomply.com/p/CODE): the referral or partner code and the time of your visit (kc_ref or kc_partner). This contains no information about you as a person. The purpose is to attribute the recommendation if you later buy something from us or send us an enquiry: with a partner code, the partner receives a commission; with a referral code, you receive the referral discount and the recommending company receives its referral bonus. When you buy, we pass the code to Stripe so that the payment can be attributed, and when you send an enquiry, we note it on the enquiry. If you take out a business subscription via a partner link, the partner sees in the partner dashboard the name of your company, the plan, since when and whether the subscription is running and their own commission from it. After 90 days we no longer take the code into account and delete the entry as soon as you then open a page that reads it (such as the home page or a purchase page); a new link replaces it. The legal basis for the attribution is our legitimate interest in settling referrals and commissions correctly (Art. 6(1)(f) GDPR). You can delete all of these entries at any time by deleting the site data for klarcomply.com in your browser.
Services used
We use the following processors under Art. 28 GDPR: Cloudflare Inc. (hosting, delivery of the website and of course media via medien.klarcomply.com, protection against attacks, visitor statistics; based in the USA; visitors from the EU are usually served from data centres in the EU, and the course media are stored in the EU; EU standard contractual clauses and EU-US Data Privacy Framework), Supabase Inc. (database, sign-in and server functions; based in the USA; the database is located in the EU, data centre Frankfurt; EU standard contractual clauses for any access from third countries) and Google Ireland Ltd. (Google Workspace: email via kontakt@klarcomply.com, calendar with booking page and video meetings via Google Meet; a transfer to Google LLC in the USA is possible and safeguarded by the EU-US Data Privacy Framework and EU standard contractual clauses). Payments are handled by Stripe Payments Europe Ltd. (Ireland) as an independent controller; card data never reaches us, we only see that and what was paid for. We also store our program code, working documents and encrypted backups of the database with GitHub Inc. (USA; EU-US Data Privacy Framework) and in Microsoft OneDrive (Microsoft Ireland Operations Ltd.; a transfer to Microsoft Corp. in the USA is possible and safeguarded by the EU-US Data Privacy Framework). For visitor statistics we use Cloudflare Web Analytics: when a page is loaded, a small script from Cloudflare (static.cloudflareinsights.com) reports the page visited and the referring page, loading times as well as browser, operating system and device type to Cloudflare. It sets no cookies, stores nothing in your browser, builds no profiles and does not track you across other websites. It does not run in the signed-in areas (account, course, partner dashboard), on the personal partner documents or on the certificate check. We only see aggregated figures, for example how often a page was visited. The legal basis is our legitimate interest in understanding and improving the use of our website (Art. 6(1)(f) GDPR). We count visits to a partner link and started quick checks per partner code without storing any IP address, device identifier or email address. We also count for all visitors, only as a daily total per language, how often the quick check was started and completed and how often the button to print the result or save it as a PDF was pressed. On the page for prospective partners (klarcomply.com/partner/werden/) we likewise count, without any identifier, how often it was opened, how often the commission calculator was used and how often a registration button was clicked. After a single purchase, the confirmation page asks a voluntary question as to whether you work at a company where AI is used; your answer and a click on the notice that follows are counted without any link to your account or your email address. For none of these counts do we store an identifier or an IP address, and nothing is stored on your device for them; the counts run through our own server, so our database provider does not receive your IP address.
Booking a meeting and video calls
You can book a meeting with us via a booking page in Google Calendar. We process your first name, last name, email address and company or organisation (ideally with website) as well as the voluntary details in the booking form: phone number, what you would like to discuss, your role, the number of your employees or of the companies you support, and how you heard about us. We use these details to arrange the meeting, invite you and prepare the conversation. Google sends the confirmation of your email address, the booking confirmation and, where applicable, a reminder on our behalf. We hold meetings via Google Meet, which processes video, audio, your display name and the technical data needed for the connection. We do not record meetings, and we do not have them transcribed or automatically summarised. The legal basis is Art. 6(1)(b) GDPR; if you book for a company or organisation, Art. 6(1)(f) GDPR (our legitimate interest in initiating and conducting business relationships). Google Ireland Ltd. provides the booking page, calendar and Meet as our processor (see the section on the services we use). We delete appointment data twelve months after the meeting if no contract results from it.
Processing on behalf of our customers
Where a corporate customer stores data about its staff or its own customers in the dashboard, we are not the controller for that data but a processor under Art. 28 GDPR. The basis is the data processing agreement concluded with the subscription; it is available at klarcomply.com/avv. Data subjects should address their rights to their employer as the controller; we support the employer in answering them.
Sales contacts of our partners
Our sales partners keep a list in the partner dashboard of companies and organisations they intend to approach as potential customers or multipliers. We store the company name, industry, town, country, website and LinkedIn page of the company and, only where publicly stated (for instance in the legal notice or on the company page), the name, role and LinkedIn profile of a contact person; plus status, notes and the date of the last contact. Email addresses and telephone numbers are not recorded. The entries are made by the respective partner and used for their own sales work; we provide the platform and evaluate response rates without personal data. The legal basis is the legitimate interest in initiating business contacts (Art. 6(1)(f) GDPR). Under our rules, partners may send promotional emails or messages, for example via messenger, only to people who have specifically requested this communication or have given provable consent that covers exactly this communication. Knowing someone personally, being connected on LinkedIn or receiving any reply at all is not a general permission for this. The entries are visible only to the respective partner and are deleted at the latest when the partnership ends. You can address requests about your rights directly to us (see contact); on objection we remove your entry.
In addition, we provide our partners with company details we have researched ourselves, the lead market. We are responsible for this. The lead market contains company data only and no names of persons. We only include organisations for which no individual is personally liable, such as a GmbH, UG, AG or registered association, as well as trade associations, guilds and chambers. We do not include sole traders, freelancers or partnerships in which people are personally liable (such as a GbR or a professional partnership), because information about them relates to the people behind them. We store only publicly available information about the company: company name, industry, town, country, website, where applicable the company's LinkedIn page, a note on the company's use of AI and a conversation starter. We do not include contact persons, additions such as the owner's name or profiles of individual persons. The sources are mainly the company's website and public business directories. If a partner takes over an entry, only that partner can see it; if the partner does not work on it for fourteen days or the partnership ends, it returns to us. If the company has declined to be approached, or a partner has archived the entry after contacting the company, it does not return to the lead market; we then note the company's domain on a block list and do not add the company again. This also applies to contacts that partners have entered themselves. We delete entries that are not taken over within twelve months. The legal basis is our legitimate interest in initiating business contacts (Art. 6(1)(f) GDPR). You can object at any time; we will then remove your entry, note your company's domain on the block list and not add your company again. We keep notes on the block list for as long as we operate the lead market.
Partnership enquiries
If you request a conversation about a partnership via the form at klarcomply.com/partner/, we process the company name, your name, your email address and your country, as well as the details you provide voluntarily (role, number of SME clients, industry focus, preferred model, message), in order to review your enquiry and get in touch with you. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). The details are stored in our database with Supabase (EU). We automatically delete declined enquiries six months after the decision; we automatically delete unhandled or reviewed enquiries that have not led to a collaboration no later than twelve months after receipt. If a partnership is formed, the rules of the partner agreement apply.
Partner programme: registration and partner account
If you register as a partner via klarcomply.com/partner/werden/, we process your name, your email address (for the sign-in link and your account), your role, where applicable your company and your customers’ sector, as well as your country and language. For commission statements you add, in the partner dashboard, your company or name and postal address and, voluntarily, your tax number or VAT ID, and you give us the bank details for payouts. When you sign the partner agreement, we store the version, a checksum (hash) of the signed text, the name you entered, your email address, the agreed commission rate, your browser’s identifier (user agent) and the time, so that the conclusion of the agreement can be proven. For the statements we attribute to you the customers who come via your partner code and calculate your commission each month from the paid invoices; in the dashboard you see the company name, plan and status of these customers. We also store the time of your last sign-in and, with your partner code, when you copied your link, a video link or material, in order to show you your setup progress; the dashboard sends these notifications through our own server, and we do not store an IP address for them. If you register via a partner’s invitation link, we assign you to that person as a multiplier. That person then sees in the partner dashboard your name, your partner code, your country, since when you have been taking part and the number of your customers, and receives from us a separate share of your customers’ revenue; your own commission is not reduced by this. The legal basis is the partner agreement and the steps leading up to it (Art. 6(1)(b) GDPR), our legal obligation for keeping the statement records (Art. 6(1)(c) GDPR) and our legitimate interest in proving the signature (Art. 6(1)(f) GDPR). If you open protected partner documents via your personal link, for example the commission model or the conversation guide, we log your partner code, which document you opened, the language and the time. This serves to protect our confidential partner documents against disclosure and misuse; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We delete these logs after six months. Which emails partners receive from us is set out in the section on emails, and how long we keep the data in the section on retention.
How long we keep data
We keep personal data only as long as the respective purpose requires or the law demands, and then delete or anonymise it. In detail: enquiries for more than 100 seats six months after receipt; enquiries about a strategic partnership twelve months after receipt; partner enquiries via klarcomply.com/partner/ as described in the section on those enquiries; partner account data until twelve months after the end of the partnership, commission statements, billing details and the record of the signed partner agreement for the retention periods under commercial and tax law; logs of opened protected partner documents for six months; appointment bookings twelve months after the meeting if no contract results from it; email correspondence once the matter is settled and no retention duty applies; dispatch logs and individually written emails as described in the section on emails; entries on the email suppression list for as long as we send emails; lead market entries and its block list as described in the section on the lead market; account and training data of business customers until twelve months after the end of the contract; account and training data from an individual course until twelve months after the last certificate expires, or without a certificate until twelve months after the last purchase; certificate data at least until the certificate expires, so that it remains verifiable; invoices and accounting records for the retention periods under commercial and tax law; notices of termination for as long as we must be able to prove their receipt (Section 312k(4) German Civil Code). For enquiries, dispatch logs, individually written emails, lead market entries that have not been taken over and logs of partner documents, deletion runs automatically once a day. We do not yet delete accounts and training data automatically, including those of partner accounts, because issued certificates must remain verifiable until they expire and billing records are linked to partner accounts. Instead, once a month we check in a documented procedure which accounts and training data have reached the periods stated above, and then delete them. As a rule, once a week we place an encrypted backup of the database in our non-public code repository (at GitHub and in Microsoft OneDrive, see the section on the services we use). It serves only to restore data after a technical failure. The backups may also contain data that we have already deleted from our live records; it disappears from them only when we remove the older backups. If we have to restore a backup, we repeat the deletions that are due and apply the block lists again before we use the data.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). You can lodge a complaint with any data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority competent for us is the Information and Data Protection Commissioner in Malta (idpc.org.mt).
Right to object
Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing that data unless we can demonstrate compelling legitimate grounds that override your interests.
Contact for data protection requests
Tel.: +356 7707 6436
E-Mail: kontakt@klarcomply.com
Web: klarcomply.com
As of September 2026 · This policy is updated when changes occur.
