Privacy Policy

The data controller responsible for your personal data is:

Komplya Ltd Todoroni Kukli 4 Sofia, Bulgaria Email: legal@komplya.com

We collect the following categories of personal data:

• Account and contact data: name, email address, and company details you provide when you sign up for the Komplya product application at portal.komplya.com.
• Compliance questionnaire responses: information you submit about your company, its use of AI, and its data processing activities, which we use to generate your applicability report and draft policies.
• Usage and technical data: information such as your IP address, browser type, device information, and pages visited, collected through standard web server logs when you use our website or product. We may use privacy-respecting analytics tools to understand how the Service is used.

We process personal data for the following purposes and on the following legal bases under the GDPR:

• To create and manage your account and deliver the Service, including generating applicability reports and policy drafts — necessary for the performance of a contract with you.
• To maintain the security and proper functioning of our website and product, and to understand basic usage patterns — based on our legitimate interest in operating and improving the Service.
• To send you marketing communications, where applicable — based on your consent, which you may withdraw at any time.

We share personal data with third parties who process it on our behalf, under appropriate data processing agreements:

• AI providers: when you use Komplya to generate an applicability report or draft a policy, the compliance information you submit is processed by a third-party AI provider (Anthropic) in order to produce that output.
• Infrastructure and hosting providers: providers that host our website and product application process personal data on our behalf to operate the Service. Further details are available on request by contacting legal@komplya.com.

Some of our processors may process personal data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses, or transfers to countries recognized as providing an adequate level of protection.

We retain personal data for as long as necessary to provide the Service and fulfil the purposes described in this Policy, including to comply with our legal, accounting, or reporting obligations. When personal data is no longer needed for these purposes, we delete or anonymize it.

If you are located in the European Economic Area, you have the following rights under the GDPR in relation to your personal data: the right to access, rectify, or erase your data; the right to restrict or object to processing; the right to data portability; and the right to withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at legal@komplya.com.

You also have the right to lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection (KZLD), or the supervisory authority in your own country of residence.

Our website may use cookies or similar technologies necessary for it to function and, where used, cookies to understand usage of the site. Where required by law, we will ask for your consent before setting non-essential cookies, and you will be able to manage your preferences through a cookie banner or settings on the website.

If you have questions about this Privacy Policy or how we handle personal data, contact us at legal@komplya.com.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the updated policy on this page with a revised effective date. We encourage you to review this page periodically.