We are committed to protecting your personal data and ensuring that you have a positive experience on Compliance Labs’s Websites and when using our Services. This Privacy Policy explains how we collect, use, and share your personal data, and your rights regarding our processing of it.
This Privacy Policy is issued in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR“).
Data Controller. References to “we”, “us”, or “Compliance Labs” in this Policy are references to SASU Compliance Labs, registered office at Tour Ariane, 5 place de la Pyramide, 92088 Paris La Défense CEDEX, France, acting as data controller for the processing described below.
For any question or request regarding this Policy or your personal data, contact us at contact@compliance-labs.com or via our contact form at https://www.compliance-labs.com/contact/. Compliance Labs’s Data Protection contact can be reached at contact@compliance-labs.com for any privacy-related question or request.
This Privacy Policy applies to personal data we process in connection with:
This Privacy Policy applies to personal data collected when you:
We collect personal data when you create a user account, submit software for evaluation, or engage with us via phone or email, including: your full name, contact details, business email address, and phone number, and the details of our communications with you.
We use this information to: maintain your user account; send service emails; provide consultation services and respond to service queries; send marketing communications to business contacts about Compliance Labs and software of potential interest; manage software evaluation activities; manage our services and Websites, including investigating complaints; answer your queries and personalize your experience; resolve disputes; conduct internal analysis and research; and ensure no prohibited or illegal activity is planned.
Where we create or maintain a Profile for a software vendor, we may collect and process limited personal data about individuals associated with that vendor, for example, names and professional contact details of company representatives listed on the vendor’s own website or public regulatory filings, without collecting it directly from that individual. We use this information solely to identify and contact the Vendor for purposes of Profile creation, verification, and account management. Our legal basis for this processing is our legitimate interest in maintaining an accurate and useful catalog of software vendors mapped against cybersecurity, OT, and AI regulatory frameworks (GDPR Art. 6(1)(f)). If you are such an individual, you have the rights described in “Data Subject Rights” below, including the right to object to this processing at any time.
Information taken from our Website logs: equipment information (brand, device model, screen dimensions), unique identifiers (IP address, device ID), browser information (type, URL, visited pages, date/time of access), traffic and location data, and source of access. We also collect behavioral data and data from cookies (see “Cookies and Related Technologies” below).
We only process personal data where we have a legal basis to do so under the GDPR:
Where we rely on legitimate interest, you may object to that processing at any time; we will stop unless we demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
We may monitor or record calls for training, quality assurance, and research. Recordings are treated as confidential. If you do not wish a call to be recorded, you may opt out at the start of the call.
We may disclose personal data:
We may also share anonymized or aggregated information that does not identify you to develop and improve our content and Services.
You have the right, in certain circumstances, to: access your personal data; request rectification; request erasure; request restriction of processing; object to processing based on our legitimate interest, including for direct marketing; request data portability; and withdraw consent where processing is based on consent. To exercise any of these rights, contact us at contact@compliance-labs.com or via our contact form. We may request information to verify your identity before acting on your request, and will respond within the timeframe required by the GDPR (in most cases, within one month, extendable by two further months for complex requests).
You also have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.
The California law requires us to provide the residents of the state of California with some additional information about how we collect, use, and share your personal data.
In this Policy, we present in detail the specific types of personal data that we may gather from or about you. Here are the categories of personal data that we have collected:
For operational purposes, we may disclose some of the categories of personal data identified above, if such use is appropriate and necessary concerning the circumstances and the operational purpose for which the information was collected or processed.
Compliance Labs have not engaged in sale of personal data activity according to the definition of “sell” under California law and under current regulatory guidance in the past 12 months including not selling the personal data of minors under 16 years of age.
Further, information identified in Sections “Information We Collect About You” and “When We Disclose Personal Data” of this Policy may be shared with third parties to collect certain information about your activity, for example, with the help of using cookies, as described in the Compliance Labs Cookie Policy.
The law of the state of California may give you certain rights to you and may entitle you to request:
You have the right to be told of any financial incentives that we may give you, if any. You also have the right not to be discriminated against because you exercise any of the rights under this notice. Note that certain information may be exempt from such a request under applicable law. For example, we require some kinds of information to provide you with the Services and to comply with applicable law. If you ask us to delete certain information, you may not be able to continue to access or use the Services.
If you would like to exercise any of these rights, please contact us at contact@compliance-labs.com. You will need to confirm your identity before we can fulfil your request.
California Online Privacy Protection Act Notice Concerning Do Not Track Signals. “Do Not Track.” DNT is a feature offered by some browsers which, when enabled, sends a signal to websites to request that your browsing is not tracked, including by third parties like social networks, analytics companies, and ad networks. Due to the fact that there is no common understanding about how to interpret Do Not Track signals yet, we do not respond to those signals at the moment.
Where personal data is transferred outside the European Economic Area, for example, to a supplier or service provider located in a third country, we rely on appropriate safeguards required by the GDPR, in particular the Standard Contractual Clauses approved by the European Commission, or another approved transfer mechanism, as applicable to each recipient. We use a limited number of service providers for hosting, communications, and business tools; where any of them are located outside the EEA, the transfer is covered by Standard Contractual Clauses or another valid transfer mechanism.
We retain personal data for 365 days from the date of collection or from your last interaction with us, whichever is later, except where a longer period is required to comply with a legal, tax, or accounting obligation, or to establish, exercise, or defend legal claims. Personal data is deleted or anonymized at the end of this period unless renewed by further activity on your account or Profile.
You may opt out of marketing messages via the unsubscribe link or by contacting contact@compliance-labs.com; we will continue to send service-related communications regardless. We do not sell or disclose your information to third parties for their own promotional purposes without your permission, except as permitted by law.
Compliance Labs implements technical, administrative, and physical security measures designed to protect your information from unauthorized access. No method of transmission or storage is 100% secure. Access to your information is restricted to employees and suppliers who need it to operate, develop, improve, or deliver our Websites and Services.
A cookie is a small text file sent by a web server to your browser when you visit our Websites. We use cookies and similar technologies (including web beacons/pixels) to make our Websites work, understand how they are used, and improve our content and services.
When you first visit our Websites, a consent banner lets you accept or decline non-essential cookies before they are placed (opt-in), in line with CNIL guidance. Your choice is remembered for up to 12 months, after which the banner is shown again. You can change your preferences at any time through the cookie settings link on our Websites.
More detail on the specific cookies we use is available in our Cookie Policy.
Links: Our Websites may link to third-party websites not covered by this Policy; your information is then subject to their own privacy practices.
Changes to this Policy: We may update this Policy from time to time; changes are effective from the date posted on this page and the “Last updated” date below is revised accordingly.
Last updated on September 25, 2026.
