Privacy Policy

Introduction

VantarGroup LLC ("Matproof", "we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our compliance automation platform.

Information We Collect

We collect information that you provide directly to us, including:

• Account information (name, email address, company name)
• Billing information (processed securely through our payment processor)
• Communications you send to us (support requests, feedback)
• Compliance data you upload to our platform (policies, evidence, controls)

How We Use Your Information

We use the information we collect to:

• Provide and maintain our compliance platform
• Process your transactions and manage your account
• Send you technical notices and support messages
• Respond to your comments, questions, and customer service requests
• Analyze usage patterns to improve our services (in aggregate, anonymized form)
• Send marketing communications (with your consent, where required)

Data Storage and Security

Your data is stored exclusively in EU data centers located in Germany. We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include encryption at rest and in transit, access controls, and regular security assessments.

Your Rights Under GDPR

As a data subject in the European Union, you have the following rights:

• Right of access: You can request a copy of your personal data
• Right to rectification: You can request correction of inaccurate data
• Right to erasure: You can request deletion of your personal data
• Right to data portability: You can request your data in a machine-readable format
• Right to object: You can object to processing of your personal data
• Right to withdraw consent: You can withdraw consent at any time where we rely on consent to process your data

Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide our services when you sign up or request a demo.
• Legitimate interests (Art. 6(1)(f)): Analytics to improve our website and services, where our interests do not override your rights.
• Consent (Art. 6(1)(a)): Marketing communications and contact form submissions, where you have explicitly consented.

Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Specifically: contact form inquiries are retained for 24 months. Account data and customer compliance data uploaded to the platform are retained for the duration of the contractual relationship; on cancellation a 30-day grace period begins during which the data may be exported (right to data portability), after which automatic hard-deletion occurs. Analytics data is aggregated/anonymised and retained for up to 26 months. Longer retention applies only where statutory rules (e.g. German Commercial Code § 257 for billing-related records, 10 years) require it. You may request deletion at any time.

Cookies and Analytics

On matproof.com (marketing site) we use Umami Analytics for aggregate, cookie-free reach measurement, and — only after your explicit consent via our cookie banner — Google Ads conversion tracking. Both tools are loaded only after consent is granted (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Inside the logged-in platform app.matproof.com we use PostHog for product analytics (EU Cloud Frankfurt, also consent-based). You can withdraw consent at any time via the banner or by clearing your browser storage. See our Cookie Policy for details.

Sub-Processors

We use the following sub-processors under Art. 28 GDPR. The "Surface" column indicates which providers serve only the public website (matproof.com), only the logged-in platform (app.matproof.com), or both. All providers have data processing agreements in place. For providers headquartered or processing data outside the EU (in particular USA, UK), EU Standard Contractual Clauses (SCC 2021/914) under Art. 46 GDPR plus supplementary technical and organisational measures are in place. Note: data submitted through web forms (contact, tool requests, assessments) is additionally written to our self-hosted Twenty CRM instance (running on our own Hetzner infrastructure in Germany, reachable at crm.klyntos.com) for follow-up tracking. This is not an external sub-processor but an internal tool on the already-listed Hetzner infrastructure.

Last list update: 20 May 2026. We give existing customers at least 30 days' advance notice of changes.

International data transfers

Where we engage subprocessors based or processing data outside the EU/EEA (in particular USA, UK, and EU subsidiaries of US-parent groups), transfers rely on the following safeguards under Articles 44 et seq. GDPR: (1) for the UK: the EU adequacy decision of 28 June 2021; (2) for the USA and other third countries: EU Standard Contractual Clauses (Implementing Decision 2021/914, Module 2 or 3 as applicable); (3) supplementary technical and organisational measures including encryption, pseudonymisation where possible, zero-data-retention arrangements with AI providers, and contractual purpose limitation. We maintain an internal Transfer Impact Assessment (TIA) for each third-country subprocessor.

Contact & Data Protection

For questions about this Privacy Policy, to exercise your GDPR rights, or to reach our data protection contact, please write to:

VantarGroup LLC
Data Protection Contact
Email: privacy@matproof.com
30 N Gould St Ste R, Sheridan, WY 82801, USA

You also have the right to lodge a complaint with your local supervisory authority. In Germany: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Berlin.