RegulatoryBridge Global Ltd. (77 Lower Camden Street, Saint Kevin's, D02 XE80 Dublin 2, Ireland; company number Pending - see CRO filing) ("RegulatoryBridge", "we", "us", "our") is the controller of personal data processed in connection with this website (regulatorybridge.com) and the services we provide.

Data Protection Officer: Our DPO can be reached at dpo@regulatorybridge.com, or by post to the registered office above (mark correspondence "Attn: Data Protection Officer").

EU Representative (Article 27 GDPR): RegulatoryBridge EU Representative (to be appointed), Pending - to be designated under Article 27 GDPR — eu-rep@regulatorybridge.com.
UK Representative (Article 27 UK GDPR): RegulatoryBridge UK Representative (to be appointed), Pending - to be designated under Article 27 UK GDPR — uk-rep@regulatorybridge.com.

See our Imprint / Legal Notice for full entity disclosures.

This policy describes how we process personal data when you (i) visit this website, (ii) request information, a demo, or a sales conversation, (iii) sign up for our services, (iv) subscribe to communications, or (v) interact with us as a business partner, supplier, or job applicant.

When we provide privacy representation or data protection officer services to our customers, our customer is the controller of their end-users' personal data and RegulatoryBridge acts as a processor under a separate Data Processing Agreement. That processing is governed by the DPA in place with the customer, not by this policy.

• Identification & contact data — name, business email, business phone, job title, employer, country.
• Account data — username, hashed password, account preferences, MFA enrolment.
• Service data — DSAR requests, breach details, compliance assessments, ROPA entries, and other data you upload to operate your compliance programme.
• Billing data — billing contact, tax ID, billing address, invoice history. Payment card data is processed by our PCI-DSS-compliant payment processor and not stored by us.
• Usage & device data — IP address (truncated where possible), browser, device type, referrer URL, pages viewed, timestamps, session events.
• Communications — emails, support tickets, and notes from sales or onboarding calls.
• Marketing preferences — subscription status, consent records, opt-out timestamps.
• Recruitment data (only if you apply for a role) — CV, work history, references, right-to-work indicators.

We do not intentionally collect special-category data (Article 9 GDPR) or sensitive personal information (CPRA, DPDPA) about prospects or website visitors. If you upload such data into our services for compliance use cases, our processor obligations under the DPA apply.

• Directly from you — forms, account sign-up, support requests, calls, emails.
• Automatically — through our website, product analytics, and security logging.
• From third parties — your employer (if you are nominated as their contact), publicly available business directories, conference sponsors, referral partners.

The lawful bases below reference GDPR Article 6 (and CCPA/CPRA business purposes where applicable):

We share personal data only with parties who have a legitimate need to receive it:

• Cloud infrastructure — AWS, Vercel, Cloudflare (CDN, edge compute, DDoS, WAF).
• Email & communications — transactional and marketing email providers.
• Analytics & product telemetry — analytics provider (only with your consent).
• CRM & sales automation — to manage commercial relationships.
• Payment processing — PCI-DSS-certified processor.
• Professional advisors — auditors, accountants, lawyers, insurers under confidentiality obligations.
• Regulators or courts — only where required by law or with your consent.

An up-to-date list of sub-processors is available on request from dpo@regulatorybridge.com. We notify customers of material sub-processor changes in line with the relevant DPA.

We may transfer personal data outside your country of residence. Where the destination is not covered by an EU/UK/Swiss adequacy decision, we rely on appropriate safeguards under GDPR Art. 46:

• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the UK Addendum or the IDTA for UK transfers.
• Binding Corporate Rules with intra-group recipients where in place.
• Transfer Impact Assessments under Schrems II for destinations of concern.

For data principals in India under DPDPA, cross-border transfers are made only to jurisdictions not restricted by the Central Government. For Brazil (LGPD), transfers rely on ANPD-approved mechanisms (Resolution 19/2024). For Japan (APPI), transfers occur with consent or equivalent-protection arrangements. A copy of the transfer mechanism in place for your data is available on request.

• Account data — duration of the contract plus 90 days for export.
• Billing records — minimum statutory retention (typically 6–10 years for tax/accounting in most jurisdictions).
• Support tickets — 3 years after resolution.
• Marketing list data — until you withdraw consent, then 30 days for system propagation.
• Security & audit logs — 12 months by default (longer where law requires).
• Recruitment data — 12 months after the role is filled (longer with your consent).

We implement technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
• Role-based access with least-privilege, MFA on administrative access, hardware-key requirement for production access.
• Continuous logging, anomaly detection, and 24×7 incident response.
• Annual penetration testing and quarterly vulnerability scanning.
• SOC 2 Type II and ISO 27001 control mapping (certifications in progress where applicable).
• Vendor risk assessments before engaging any sub-processor.

Despite all controls, no system is perfectly secure. If a breach affects your personal data, we will notify you and/or the competent supervisory authority in accordance with applicable law.

• Access — confirmation of processing and a copy of your data.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion in defined circumstances.
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a structured, commonly used format.
• Object — to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time, as easily as you gave it.
• Not be subject to a solely-automated decision producing legal or similarly significant effects.

To exercise any of these rights, contact dpo@regulatorybridge.com. We respond within one month (extendable by two months for complex requests). Where we cannot verify your identity, we will ask for additional information.

California (CCPA / CPRA). California consumers also have rights to know, delete, correct, opt-out of sale or sharing of personal information, limit use of sensitive personal information, and not be discriminated against for exercising rights. We honour Global Privacy Control signals. We have not sold personal information in the preceding 12 months. To exercise CCPA rights email privacy@regulatorybridge.com.

India (DPDPA). Data principals have the rights of access, correction/completion/updating, erasure, grievance redressal, and nomination, and may withdraw consent at any time. Contact dpo-india@regulatorybridge.com.

United Kingdom (UK GDPR). You can lodge a complaint with the Information Commissioner's Office (ico.org.uk).

Brazil (LGPD). You may exercise the rights set out in Article 18 LGPD by writing to our Encarregado at encarregado@regulatorybridge.com; you may also escalate to ANPD.

Singapore (PDPA). Our DPO is the contact for access, correction, and withdrawal of consent under the PDPA.

Japan (APPI). You may request disclosure, correction, cessation, or deletion under Articles 28–35 APPI by contacting our Personal Information Manager at appi@regulatorybridge.com.

Switzerland (revFADP). Equivalent rights apply; complaints may be filed with the FDPIC.

Our services are not directed at children under 16, and we do not knowingly collect personal data from anyone we believe to be under 16. If you believe a child has provided personal data to us, please contact dpo@regulatorybridge.com and we will delete it promptly. Where customers process children's data using our services, the customer is responsible for obtaining required parental consent.

We do not use solely-automated decision-making that produces legal effects or similarly significantly affects you. Some operational systems (e.g., spam filtering, anomaly detection) apply automated logic with human oversight. Where this changes, we will update this policy and obtain consent or another lawful basis as appropriate.

We use cookies for: (i) necessary functions such as routing, security, and session continuity; (ii) optional analytics — only with your consent; (iii) optional marketing — only with your consent. You manage your choice via the cookie banner displayed on first visit and at any time via "Cookie Settings" in our footer (link coming soon). For details about specific cookies, durations, and providers, see our forthcoming Cookie Notice.

We'd like the chance to resolve your concern first — please write to dpo@regulatorybridge.com. You also have the right to lodge a complaint with your local supervisory authority. The Data Protection Authority of our lead establishment is the Data Protection Commission (Ireland).

We may update this policy from time to time. Material changes will be announced on this page and, where appropriate, via email or in-product notification at least 14 days before they take effect. The version and date at the top of this page indicate the current iteration.

Email: privacy@regulatorybridge.com
Data Protection Officer: dpo@regulatorybridge.com
Post: RegulatoryBridge Global Ltd., Attn: Data Protection Officer, 77 Lower Camden Street, Saint Kevin's, D02 XE80 Dublin 2, Ireland.