Legal

EvRisko Privacy Notice

Effective date: 01 October 2026 · Last updated: 03 November 2026

General

Terms and conditions Acceptable use policy Refund & cancellation policy

Privacy and Security

Privacy notice Cookie notice Data Processing Addendum Security annex

This Privacy Notice explains how TechComply collects, uses, discloses, and protects personal information when you visit our website, create an Account, use the Services, contact us, or otherwise interact with us, or when we contact you or your business.

1. Who we are

TechComply is the data processor in regards to the provision of the EvRisko web application and the related services. Client is the data controller and decides how its personal data is used in connection to the Services.

TechComply
Amsterdam, the Netherlands
Email: techcomplynl@gmail.com

2. Information we collect

We may collect:

•Account and company information:

–name;

–work email address;

–job title;

–company name;

–company size, industry, and location;

–username and authentication information;

–billing and subscription details;

–communications with us; and

–account preferences.

•Questionnaire and risk information:

–questionnaire responses;

–details on IT systems, processes, suppliers, controls, and risks;

–information about remediation activities;

–risk scores, classifications, and recommendations; and

–report and dashboard information.

Note: Client should not enter passwords, payment card details, private encryption keys, or unnecessary special category Personal Data into questionnaire fields.

•Technical and usage information:

–account details;

–IP address;

–browser and device information;

–operating system;

–log-in and access times;

–pages and features used;

–error logs;

–approximate location derived from IP address; and

–cookies and similar technologies.

•Business contact information from public sources:

–name, job title and employer;

–work email address and public company contact details;

–public professional profile links, such as LinkedIn;

–company information, such as size, industry, registration details and business description; and

–public business events, such as job advertisements, funding, acquisitions and audit requirements.

We collect this information from public sources, including company websites, business registers, professional networks, job advertisements and news articles, when we identify businesses that may be interested in the Services.

•Private information pages:

We may prepare a private web page for a business we contact. We record the date and number of times that page is opened. We do not use cookies on these pages or record who opened them.

Payment information

Payments are processed by Stripe. We may receive limited information such as payment status, transaction identifier, card type, billing country, and the last four digits of a payment card. We do not generally receive or store full payment-card numbers.

3. How we use information

We use information to:

•create and administer Accounts;

•provide dashboards, reports, recommendations, and remediation actions;

•process subscriptions and payments;

•authenticate users and maintain account security;

•provide Client support;

•communicate about the Services, billing, and service changes;

•monitor performance and troubleshoot problems;

•detect fraud, abuse, and security incidents;

•comply with legal obligations;

•enforce our agreements; and

•identify businesses that may be interested in the Services, contact them, and prepare private information pages for them;

•create aggregated or de-identified statistics and improve the Services.

Where permitted by law, we may send marketing communications. You can opt out at any time using the unsubscribe link or by contacting us.

4. Legal bases

Where GDPR or UK GDPR applies, we rely on the following legal bases:

Purpose	Legal basis
Creating and managing an Account	Performance of a contract
Providing the Services	Performance of a contract
Processing payments	Performance of a contract and legal obligations
Security and fraud prevention	Legitimate interests and legal obligations
Product analytics and service improvement	Legitimate interests, consent where required
Direct marketing	Consent or legitimate interests, where permitted
Identifying and contacting businesses, and preparing private information pages	Legitimate interests, consent where required. Our legitimate interest is telling businesses about services that may be relevant to them. You can object at any time, see section 9.
Legal claims and compliance	Legal obligations and legitimate interests

5. Client Data and our role

When a business Client submits Personal Data through the Services, Client acts as data controller and TechComply acts as data processor under the GDPR. The Data Processing Addendum applies to that processing.

For information about our own website, account administration, billing, marketing, security, and support activities, we may act as an independent data controller. This includes business contact information from public sources and private information pages, for which TechComply acts as an independent data controller.

6. Sharing information

We may share information with the following natural or legal entities with the sole purposes of providing you the Services:

•hosting and cloud infrastructure providers (our website is hosted by Vercel Inc.);

•payment processors;

•authentication, email, analytics, monitoring, and support providers (website visit statistics are collected with Vercel Web Analytics, without cookies);

•spreadsheet, research and writing tools, including AI tools, that we use to keep business contact records and prepare private information pages;

•scheduling tools (if you book a call with us, the details you enter are handled by Calendly);

•professional advisers;

•auditors and insurers;

•regulators, courts, law-enforcement authorities, or other bodies where legally required; and

•a purchaser or successor in connection with a merger, acquisition, financing, or sale of assets.

We do not sell personal information. We do not disclose Client Data to third parties except as necessary to provide the Services, operate our business, comply with law, or as otherwise described in this Notice.

7. International transfers

Some service providers may process information outside your country. Where required, we use appropriate transfer safeguards, such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, and supplementary security measures.

8. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Notice, including to:

•provide the Services;

•maintain business and financial records;

•resolve disputes;

•enforce agreements;

•prevent fraud and abuse; and

•comply with legal obligations.

After an Account is terminated, Client Data is generally deleted or anonymized within 30 days, subject to backups, legal retention requirements, and the Data Processing Addendum.

Private information pages are deleted three weeks after they are shared with you. Business contact information is deleted within 12 months after our last contact, unless a business relationship has started. If you object to being contacted, we keep only the minimum needed to make sure we do not contact you again.

9. Your data protection rights

Depending on your location, you may have the right to:

•request access to Personal Data;

•request correction;

•request deletion;

•request restriction of processing;

•object to processing;

•request data portability;

•withdraw consent;

•object to direct marketing; and

•lodge a complaint with a data protection authority.

Requests may be sent by using the contact form. We may need to verify your identity before addressing your inquiry further.

If we contacted you using information from public sources, you can object or ask us to delete your information at any time by replying to our message or using the contact form. We will then stop contacting you.

10. Cookies

Our website uses cookies and similar technologies for essential operation, authentication, security, preferences, analytics, and marketing where applicable.

For more information, see our Cookie Notice.

11. Security

We use reasonable technical and organizational safeguards designed to protect Personal Data. However, no online service is completely secure. Clients are responsible for configuring their Accounts and access controls appropriately. More information on our security controls can be found in our Terms & Conditions and Security Annex.

12. Children

The Services are intended for business users and are not directed to children. We do not knowingly collect Personal Data from children.

13. Changes

We may update this Privacy Notice from time to time. We will post the updated version and change the “Last updated” date. Where legally required, we will provide additional notice. We will not obtain your approval for the implementation of said changes.

14. Contact and complaints

Questions or requests should be sent to:

TechComply
Amsterdam, the Netherlands
Email: techcomplynl@gmail.com

You may also contact the relevant data protection authority in your country of residence or operation.