How we handle your data.

The controller within the meaning of Art. 4 no. 7 GDPR for the processing of personal data via the CIVAC website and platform is:

CITO GmbH
Jungfrauenthal 8
20149 Hamburg, Germany
Email: info@civac.de

CIVAC is a brand of CITO Holding Gruppe GmbH. Further company details are available in the Legal Notice.

Our external data protection officer has been appointed in accordance with Art. 37 GDPR. You may contact the data protection officer in writing at the postal address above (marked “attn. Data Protection Officer”) or by email at info@civac.de (please mark “attn. Data Protection Officer”).

CIVAC acts in two distinct capacities, depending on the processing activity:

• Controller: with respect to personal data processed through the public website, marketing activities, sales communications, account creation, billing and the administration of our business relationship with customers, prospects and partners.
• Processor: with respect to personal data that our customers upload or generate within the CIVAC platform while using the service (e.g. officer records, training progress, compliance documentation, uploaded files). For this data, the customer remains the controller and a separate data processing agreement pursuant to Art. 28 GDPR governs our processing.

We process personal data on the following legal bases of Art. 6 GDPR and for the retention periods set out below:

Personal data is disclosed only where necessary and on an appropriate legal basis. Potential recipients include:

• affiliates of CITO GmbH, where the processing purpose warrants this;
• sub-processors engaged on behalf of our customers for the provision of the platform (hosting, email delivery, analytics, support tooling, AI inference providers). An up-to-date list is available on request and, for the platform, via the customer workspace;
• other platform users of the same customer workspace, where collaboration features make this necessary (e.g. shared tasks, assignments, documents);
• payment providers, professional advisors (auditors, tax consultants, lawyers) bound by professional secrecy;
• competent courts, authorities and public bodies, where we are legally obliged or entitled to disclose.

We primarily process personal data within the European Union and the European Economic Area. Where personal data is transferred to third countries, we ensure an appropriate level of protection in accordance with Chapter V GDPR, in particular by relying on:

• an adequacy decision of the European Commission (Art. 45 GDPR);
• the EU standard contractual clauses (Art. 46(2)(c) GDPR), supplemented by technical and organisational measures where required;
• the EU-U.S. Data Privacy Framework for certified US recipients.

You may request a copy of the relevant safeguards from the contact address above.

We retain personal data only for as long as necessary to achieve the purposes for which it was collected and in accordance with statutory retention obligations, in particular:

• ten years for tax-relevant documents pursuant to § 147 of the German Fiscal Code (AO);
• six years for commercial letters and other business records pursuant to § 257 of the German Commercial Code (HGB);
• three months after the purpose has ceased for data without a statutory retention obligation, after which the data is deleted or anonymised.

Subject to the statutory conditions, you have the following rights in relation to personal data we process about you:

• right of access (Art. 15 GDPR);
• right to rectification (Art. 16 GDPR);
• right to erasure (Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR);
• right to withdraw consent at any time, with effect for the future (Art. 7(3) GDPR);
• right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

The supervisory authority responsible for CITO GmbH is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg, Germany

You are of course free to contact the supervisory authority of your place of residence, place of work or the place of the alleged infringement.

CIVAC uses AI-assisted features to support compliance work (in particular, AI-assisted drafting of documents, suggestions and recommendations). These features generate drafts and recommendations only; they do not render automated decisions that produce legal effects concerning data subjects or similarly significantly affect them within the meaning of Art. 22(1) GDPR. Any decision having legal effect is taken by the responsible officer or the management of our customer.

You retain, at all times, the right to human intervention on the part of the controller, the right to express your point of view and the right to contest a decision.

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access (Art. 32 GDPR). Measures include transport encryption (TLS), encryption at rest, role-based access controls, logging and a dedicated information-security programme. Further details are available in our separate Security Policy, which supplements this privacy policy.

We may update this privacy policy from time to time to reflect changes to the service, our processing activities or applicable law. The current version is always available on this page. Where the changes are material, we will inform you in an appropriate manner, for example by email or through a notice in the platform.

For any question regarding this privacy policy or the processing of your personal data, please contact us at info@civac.de.