§1. Who we are (Controller)
RegulatoryBridge (legal name pending registration) (Registered office address pending, City pending, Country to be confirmed; company number Pending registration) ("RegulatoryBridge", "we", "us", "our") is the controller of personal data processed in connection with this website (regulatorybridge.com) and the services we provide.
Data Protection Officer: Our DPO can be reached at dpo@regulatorybridge.com, or by post to the registered office above (mark correspondence "Attn: Data Protection Officer").
EU Representative (Article 27 GDPR): EU representative (to be appointed), To be designated under Article 27 GDPR - eu-rep@regulatorybridge.com.
UK Representative (Article 27 UK GDPR): UK representative (to be appointed), To be designated under Article 27 UK GDPR - uk-rep@regulatorybridge.com.
See our Imprint / Legal Notice for full entity disclosures.
§2. Scope of this policy
This policy describes how we process personal data when you (i) visit this website, (ii) request information, a demo, or a sales conversation, (iii) sign up for our services, (iv) subscribe to communications, or (v) interact with us as a business partner, supplier, or job applicant.
When we provide privacy representation or data protection officer services to our customers, our customer is the controller of their end-users' personal data and RegulatoryBridge acts as a processor under a separate Data Processing Agreement. That processing is governed by the DPA in place with the customer, not by this policy.
§3. Categories of personal data we process
- Identification & contact data - name, business email, business phone, job title, employer, country.
- Account data - username, hashed password, account preferences, MFA enrolment.
- Service data - DSAR requests, breach details, compliance assessments, ROPA entries, and other data you upload to operate your compliance programme.
- Billing data - billing contact, tax ID, billing address, invoice history. Payment card data is processed by our PCI-DSS-compliant payment processor and not stored by us.
- Usage & device data - IP address (truncated where possible), browser, device type, referrer URL, pages viewed, timestamps, session events.
- Communications - emails, support tickets, and notes from sales or onboarding calls.
- Marketing preferences - subscription status, consent records, opt-out timestamps.
- Recruitment data (only if you apply for a role) - CV, work history, references, right-to-work indicators.
We do not intentionally collect special-category data (Article 9 GDPR) or sensitive personal information (CPRA, DPDPA) about prospects or website visitors. If you upload such data into our services for compliance use cases, our processor obligations under the DPA apply.
§4. Where the data comes from
- Directly from you - forms, account sign-up, support requests, calls, emails.
- Automatically - through our website, product analytics, and security logging.
- From third parties - your employer (if you are nominated as their contact), publicly available business directories, conference sponsors, referral partners.
§5. Purposes & lawful bases
The lawful bases below reference GDPR Article 6 (and CCPA/CPRA business purposes where applicable):
| Purpose | Lawful basis |
|---|---|
| Provide and operate the services you contract for | Art. 6(1)(b) - contract |
| Account creation, billing, customer support | Art. 6(1)(b) - contract |
| Tax, accounting, and regulator record-keeping | Art. 6(1)(c) - legal obligation |
| Security, fraud prevention, IT logging, abuse monitoring | Art. 6(1)(f) - legitimate interests (running a secure service) |
| Sales outreach to business contacts you provide | Art. 6(1)(f) - legitimate interests, balanced against your rights |
| Marketing emails & newsletters | Art. 6(1)(a) - consent (with one-click withdrawal) |
| Non-essential analytics & advertising cookies | Art. 6(1)(a) - consent (via cookie banner) |
| Defence of legal claims | Art. 6(1)(f) - legitimate interests; or Art. 9(2)(f) for special categories |
§6. Recipients & sub-processors
We share personal data only with parties who have a legitimate need to receive it:
- Cloud infrastructure - AWS, Vercel, Cloudflare (CDN, edge compute, DDoS, WAF).
- Email & communications - transactional and marketing email providers.
- Analytics & product telemetry - analytics provider (only with your consent).
- CRM & sales automation - to manage commercial relationships.
- Payment processing - PCI-DSS-certified processor.
- Professional advisors - auditors, accountants, lawyers, insurers under confidentiality obligations.
- Regulators or courts - only where required by law or with your consent.
An up-to-date list of sub-processors is available on request from dpo@regulatorybridge.com. We notify customers of material sub-processor changes in line with the relevant DPA.
§7. International data transfers
We may transfer personal data outside your country of residence. Where the destination is not covered by an EU/UK/Swiss adequacy decision, we rely on appropriate safeguards under GDPR Art. 46:
- Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the UK Addendum or the IDTA for UK transfers.
- Binding Corporate Rules with intra-group recipients where in place.
- Transfer Impact Assessments under Schrems II for destinations of concern.
For data principals in India under DPDPA, cross-border transfers are made only to jurisdictions not restricted by the Central Government. For Brazil (LGPD), transfers rely on ANPD-approved mechanisms (Resolution 19/2024). For Japan (APPI), transfers occur with consent or equivalent-protection arrangements. A copy of the transfer mechanism in place for your data is available on request.
§8. How long we keep it
- Account data - duration of the contract plus 90 days for export.
- Billing records - minimum statutory retention (typically 6–10 years for tax/accounting in most jurisdictions).
- Support tickets - 3 years after resolution.
- Marketing list data - until you withdraw consent, then 30 days for system propagation.
- Security & audit logs - 12 months by default (longer where law requires).
- Recruitment data - 12 months after the role is filled (longer with your consent).
§9. How we protect data
We implement technical and organisational measures appropriate to the risk, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
- Role-based access with least-privilege, MFA on administrative access, hardware-key requirement for production access.
- Continuous logging, anomaly detection, and 24×7 incident response.
- Annual penetration testing and quarterly vulnerability scanning.
- SOC 2 Type II and ISO 27001 control mapping (certifications in progress where applicable).
- Vendor risk assessments before engaging any sub-processor.
Despite all controls, no system is perfectly secure. If a breach affects your personal data, we will notify you and/or the competent supervisory authority in accordance with applicable law.
§10. Your rights (everyone)
- Access - confirmation of processing and a copy of your data.
- Rectification - correction of inaccurate or incomplete data.
- Erasure - deletion in defined circumstances.
- Restriction - pause processing while a dispute is resolved.
- Portability - receive your data in a structured, commonly used format.
- Object - to processing based on legitimate interests or direct marketing.
- Withdraw consent - at any time, as easily as you gave it.
- Not be subject to a solely-automated decision producing legal or similarly significant effects.
To exercise any of these rights, contact dpo@regulatorybridge.com. We respond within one month (extendable by two months for complex requests). Where we cannot verify your identity, we will ask for additional information.
§11. Regional additions
California (CCPA / CPRA). California consumers also have rights to know, delete, correct, opt-out of sale or sharing of personal information, limit use of sensitive personal information, and not be discriminated against for exercising rights. We honour Global Privacy Control signals. We have not sold personal information in the preceding 12 months. To exercise CCPA rights email privacy@regulatorybridge.com.
India (DPDPA). Data principals have the rights of access, correction/completion/updating, erasure, grievance redressal, and nomination, and may withdraw consent at any time. Contact dpo-india@regulatorybridge.com.
United Kingdom (UK GDPR). You can lodge a complaint with the Information Commissioner's Office (ico.org.uk).
Brazil (LGPD). You may exercise the rights set out in Article 18 LGPD by writing to our Encarregado at encarregado@regulatorybridge.com; you may also escalate to ANPD.
Singapore (PDPA). Our DPO is the contact for access, correction, and withdrawal of consent under the PDPA.
Japan (APPI). You may request disclosure, correction, cessation, or deletion under Articles 28–35 APPI by contacting our Personal Information Manager at appi@regulatorybridge.com.
Switzerland (revFADP). Equivalent rights apply; complaints may be filed with the FDPIC.
§12. Children's data
Our services are not directed at children under 16, and we do not knowingly collect personal data from anyone we believe to be under 16. If you believe a child has provided personal data to us, please contact dpo@regulatorybridge.com and we will delete it promptly. Where customers process children's data using our services, the customer is responsible for obtaining required parental consent.
§13. Automated decisions & profiling
We do not use solely-automated decision-making that produces legal effects or similarly significantly affects you. Some operational systems (e.g., spam filtering, anomaly detection) apply automated logic with human oversight. Where this changes, we will update this policy and obtain consent or another lawful basis as appropriate.
§15. Complaints
We'd like the chance to resolve your concern first - please write to dpo@regulatorybridge.com. You also have the right to lodge a complaint with your local supervisory authority. The Data Protection Authority of our lead establishment is the Lead supervisory authority to be confirmed.
§16. Changes to this policy
We may update this policy from time to time. Material changes will be announced on this page and, where appropriate, via email or in-product notification at least 14 days before they take effect. The version and date at the top of this page indicate the current iteration.
§17. Contact us
Email: privacy@regulatorybridge.com
Data Protection Officer: dpo@regulatorybridge.com
Post: RegulatoryBridge (legal name pending registration), Attn: Data Protection Officer, Registered office address pending, City pending, Country to be confirmed.
Frequently Asked Questions
What categories of personal data does RegulatoryBridge process?+
Primarily contact and account identifiers, service usage and device data, billing details, and the content of communications you send us. We do not intentionally collect special-category data. The full breakdown is in the "Categories of personal data we process" section above.
What lawful basis do you rely on to process my data?+
It depends on the purpose. The "Purposes & lawful bases" table above maps each processing purpose to its basis under GDPR Article 6, with the corresponding CCPA/CPRA treatment noted where relevant. Where we rely on consent, you can withdraw it at any time.
Is my personal data transferred outside my country?+
It may be. Where personal data leaves your country of residence we rely on the transfer mechanisms described in the "International data transfers" section, such as an adequacy decision or Standard Contractual Clauses, together with any supplementary measures required. Separate conditions are noted for data principals in India under the DPDPA.
How long do you keep my personal data?+
Retention is set per purpose rather than by a single global period — account records, billing records, representation correspondence and marketing preferences each have their own retention basis. The "How long we keep it" section above lists them.
How do I exercise my data protection rights?+
Contact our Data Protection Officer at dpo@regulatorybridge.com. The "Your rights" section lists the rights available to everyone, and "Regional additions" sets out the extra rights that apply in California, India, the United Kingdom and Brazil.
Do you make automated decisions about me?+
No. We do not use solely automated decision-making that produces legal effects or similarly significant effects for you. Where our tools produce an indicative result — for example a compliance assessment — a person remains responsible for any decision that follows.
Ready to Achieve Global Regulatory Compliance?
Partner with RegulatoryBridge for comprehensive compliance representation across global jurisdictions.
