Privacy Policy
Effective: [DRAFT — pending legal review] · v1-draft
This policy explains how Nord CS GmbH processes personal data when you use the CRA assessment tool, in accordance with the GDPR.
1. Controller
Nord CS GmbH, [street, postal code, city, country]. Contact: cra@aitigrity.com. Data Protection Officer: [name / email or "not appointed — [justification]"].
2. What we collect
Contact details you enter: first name (optional), last name (optional), and work email (required).
Your questionnaire answers about the product, and any documents you choose to upload (optional).
Consent records: the date/time and version of the Terms/Privacy text you accepted, and whether you opted in to the newsletter.
Technical data needed to operate the service securely: IP address (for rate-limiting/anti-abuse) and basic attribution parameters (UTM/referrer).
3. Why we process it, and the legal basis
To generate and email your assessment — on the basis of your consent (Art. 6(1)(a) GDPR), which you give via the required consent checkbox.
To send you the optional newsletter — only if you separately opt in (Art. 6(1)(a) GDPR); you can withdraw at any time via the unsubscribe link.
To keep the service secure and prevent abuse — on the basis of our legitimate interests (Art. 6(1)(f) GDPR).
4. Recipients and processors
Hosting, file storage, and email delivery: Amazon Web Services (Amazon S3, Amazon SES), processing in [AWS region].
AI evaluation: your questionnaire answers and any uploaded documents are sent to [Anthropic] to generate the assessment. [PLACEHOLDER — legal to confirm the data-processing agreement and that a zero-retention / no-training tier is used, and document any transfer to a third country with the appropriate safeguard (e.g. EU Standard Contractual Clauses).]
We do not sell your personal data.
5. International transfers
[PLACEHOLDER — state whether any processor (e.g. the AI provider) processes data outside the EU/EEA and the safeguard relied upon (adequacy decision or Standard Contractual Clauses).]
6. How long we keep it
Uploaded documents are deleted after your assessment is generated, following a short grace window, and abandoned drafts and their uploads are deleted on expiry.
Your subscriber record (name, email, consent history, assessment result reference) is retained so we can evidence consent and provide the service, until you unsubscribe or request erasure.
[PLACEHOLDER — confirm concrete retention periods.]
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
You can unsubscribe from emails at any time using the one-click link in any email we send.
You have the right to lodge a complaint with a supervisory authority: [PLACEHOLDER — competent authority + contact].
8. Contact
For any privacy request, contact cra@aitigrity.com.