GDPR & Data Protection

Data controller

RoleComply (operated by Philip Mahler, Copenhagen, Denmark) is the data controller. Contact for all GDPR matters: philip@rolecomply.com.

What personal data we process

• Account data: name, work email, company name, job title, hashed password.
• Usage data: feature interactions, scan history, timestamps.
• Communication data: messages you send us.
• Payment data: billing name and address (card details processed by Stripe only).
• Technical data: IP address, browser type, device type.

We do not collect special category data (Article 9 GDPR). We do not collect personal data of job candidates — only the text of public job ads.

Lawful basis for processing

• Contract performance (Art. 6(1)(b)): account creation, service delivery, transactional emails.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product improvement — balanced against your privacy rights.
• Consent (Art. 6(1)(a)): marketing emails. Withdraw at any time by unsubscribing or emailing us.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and regulatory compliance data retention.

Data minimisation

We collect only the minimum necessary for each purpose. Scan logs use account identifiers rather than personal names wherever practical.

International data transfers

EU customer data is hosted on AWS eu-west-1 (Dublin, Ireland) and does not ordinarily leave the EEA. Where sub-processors operate outside the EEA, we use Standard Contractual Clauses (Decision 2021/914) as the transfer mechanism.

Data Processing Agreement

If your organisation requires a DPA, email philip@rolecomply.com. We will provide a draft within 5 business days.

Your rights under the GDPR

To exercise any right below, email philip@rolecomply.com. We respond within 30 days (extendable by 60 days for complex requests).

• Right of access (Art. 15): receive a copy of your personal data and how it is processed.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion where no overriding legal basis exists.
• Right to restriction (Art. 18): restrict processing in certain circumstances.
• Right to data portability (Art. 20): receive your data in JSON or CSV format.
• Right to object (Art. 21): object to processing based on legitimate interests or direct marketing.
• Automated decision-making (Art. 22): we do not make solely automated decisions with significant legal effects. Compliance scores are advisory only.

Cookies

See our Cookies Policy. We respect the Do Not Track (DNT) browser signal.

Security

TLS 1.2+, AES-256 at rest, MFA on all internal systems, regular security reviews. In the event of a high-risk breach, we notify the relevant supervisory authority within 72 hours and affected users without undue delay.

Children's data

RoleComply is a B2B service for professionals 18+. We do not knowingly collect data from minors. Contact us immediately if you believe we have done so.

Data retention

Account data: active period plus 90 days. Scan logs and reports: 24 months. Payment records: 7 years. Early deletion requests honoured except where a legal hold applies.

Sub-processors

• AWS (eu-west-1, Ireland): cloud infrastructure.
• Stripe, Inc.: payment processing (PCI-DSS compliant).
• PostHog (EU infrastructure): anonymised product analytics.

We give 30 days' notice before adding or replacing sub-processors. Request the current list at philip@rolecomply.com.

Supervisory authority

Denmark: Datatilsynet — datatilsynet.dk. UK: Information Commissioner's Office (ICO) — ico.org.uk. Other EU: the authority in your country of habitual residence. We would appreciate the chance to resolve concerns directly first.