Privacy Policy

1. Overview

complybox.eu is committed to protecting the privacy and security of our users' data. This Privacy Policy outlines our practices regarding data collection, usage, and protection, particularly concerning whistleblower anonymity and GDPR compliance.

2. Whistleblower Anonymity

Our platform is designed with a "privacy by design" approach. Reports submitted anonymously are completely disconnected from identifiable information such as IP addresses, browser fingerprints, or device data. The whistleblower receives a unique cryptographic key to track the report, and we have zero knowledge of their identity.

3. Data Processing for Organizations

For organizations using our service, we act as a Data Processor. We collect and process the necessary account and billing information (name, email, company details). All whistleblowing case data is encrypted using End-to-End Encryption (E2EE), meaning only authorized organizational users with the correct decryption keys can read the reports.

4. Use of AI and Analytics

complybox.eu utilizes AI to provide risk scoring and suggested responses. The data sent to AI models is strictly sanitized, anonymized, and never used to train external or public models. AI processing is secure and compliant with EU AI regulations.

5. Data Retention

We retain organizational data for as long as your account is active. Whistleblowing reports are retained according to the compliance settings configured by the organization (e.g., deleted automatically after a legal timeframe). You can request data deletion at any time.

6. Third-Party Disclosures

We do not sell, trade, or transfer your personally identifiable information or encrypted case data to outside parties. We may use trusted third-party service providers (e.g., secure hosting infrastructure in the EU) who assist us in operating our platform, subject to strict confidentiality agreements.

7. Your Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights, including the right to access, update, delete, or restrict processing of your personal information. To exercise these rights, please contact our Data Protection Officer.