EuroComply

GDPR overview

GDPR implementation was documented in unusual detail. The site claimed outright to be 'a GDPR-compliant compliance SaaS hosted in Frankfurt, Germany'. RMB Ventures, a company under Portuguese law, acts as controller, with the Portuguese CNPD (Av. D. Carlos I, 134, 1.o, 1200-651 Lisbon) as lead authority. Rights under Articles 15 to 21 are set out, with a 30-day response deadline under Article 12(3), extendable by two months. A DPA incorporating the EU controller-to-processor standard contractual clauses is available on request, transfers outside the EEA rely on SCCs under Article 46(2)(c) together with transfer impact assessments referencing Schrems II (C-311/18), and breaches are notified to the CNPD within 72 hours under Article 33. No Article 27 representative is designated, the publisher being established in the EU. The privacy policy is dated 30 March 2026.

Who owns the data?

Under the terms, the customer remains the data controller for any personal data submitted through the platform, such as ROPA entries, DPIA records and incident logs, while RMB Ventures acts only as a processor under Article 28 GDPR and processes solely on the customer's documented instructions. Compliance artefacts, including the ROPA, DPIAs, mappings and evidence items, can be exported in machine-readable form on request. The publisher aligned its exit terms with the Data Act: 30 days of egress, no exit fees and no lock-in. Article 20 portability is offered as a JSON download from Settings > Data. Ownership of the submitted content therefore stays with the customer, not with the platform.

Reuse rights

Purposes and legal bases were tabulated: Article 6(1)(b) contract for the account, AI system records, ROPA and chat; Article 6(1)(a) consent for the newsletter; Article 6(1)(f) legitimate interest for analytics. No special categories under Article 9 were processed, and no automated decision-making within the meaning of Article 22 took place. Data was not sold and not shared for advertising, and partner clicks were logged through an in-house redirect carrying no personal identifier. The decisive caveat concerns AI inference. The publisher ran on Mistral AI's 'Experiment (API)' plan, under which API requests, including prompts and responses, may be used by Mistral to improve its models. Compliance queries, AI system descriptions and classification inputs could therefore end up in model training data. Names, email addresses and direct identifiers were stated as never being sent in prompts, and no opt-out mechanism was in place.

Data retention & training

Hosting summary

Hosting was documented service by service. The database and authentication ran on Supabase in Frankfurt, Germany (AWS eu-central-1), the application and routing on Vercel's EU region in Frankfurt, with a global CDN that includes US nodes for static assets, and AI inference with Mistral AI SAS in Paris, France. Analytics used Microsoft Clarity and Google Analytics 4 in Irish data centres, while transactional email went through SendPulse in the United States under standard contractual clauses. The publisher acknowledged that Supabase Inc., Vercel Inc., SendPulse Inc., Microsoft and Google are all incorporated in the United States and covered those relationships with SCCs, while claiming that regulated workspace data does not transit through the US subprocessors. The subprocessor list was published with the country and data type for each entry and last updated in June 2026. In short, an EU-resident core with US-incorporated suppliers at the edges, disclosed rather than hidden, but disclosed on a site that is now offline and can no longer be re-verified.