Privacy Policy
This policy explains how we process personal data under Regulation (EU) 2016/679 (GDPR) and the Austrian Datenschutzgesetz 2018 (DSG). It covers this website (validopus.com) and your Validopus account, which you use to access the services we provide.
Controller
- Validopus e.U.
- Andritzer Reichsstraße 62d, 8045 Graz, Austria
- Email: office@validopus.com
- Phone: +43 699 81197274
Full details in our Impressum. No Data Protection Officer has been appointed, as none is required for our size and type of processing — use the contact details above for any privacy request.
This website (validopus.com)
This site is static — it sets no cookies, runs no analytics or tracking, and has no forms that collect your data. Visiting it does not create an account or profile with us.
Our infrastructure may retain standard web server logs (IP address, timestamp, requested page) for a short period, for security and operational purposes such as detecting abuse. This is based on our legitimate interest (Art. 6(1)(f) GDPR) in keeping the service secure and available.
Your Validopus account
Creating a Validopus account is the first step to using any of our services.
Account data. When you sign up, we process your name, email address, and optionally company and phone number, to create and administer your Validopus account. Passwords are stored using industry-standard hashing — we cannot see your password in plain text. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
One Validopus account gives you access to all of our services — you only need to log in once. Account data is shared across services on that basis. The content you create within a service is a different matter: see below.
Our services
Data you create or upload while using a specific service — assessment content, documents, findings, and similar — is processed strictly for that service and is not shared with our other services.
As of now, Validopus provides one service:
Censopus
Censopus is a process assessment tool for assessors and auditors, at censopus.validopus.com.
Assessment content. Project information, assessment scope, process ratings, strengths, weaknesses, recommendations, and notes that you enter are stored to provide the service and to generate your reports. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Evidence and interview partners. You may attach evidence documents and record interview partners (name and role) as part of documenting an assessment. For this specific data — information about people other than yourself, entered by you as part of your assessment work — you are the data controller and Validopus e.U. acts as your data processor, processing it only on your instructions. This relationship is governed by a data processing agreement under Art. 28 GDPR, available on request. You remain responsible for having a lawful basis to process this data about your interview partners.
Payment data. The €10 report fee is processed by Stripe. Stripe handles your card details directly — we never see or store your full card number. We retain a record of the transaction (amount, date, invoice reference) for our own accounting.
Cookies. Censopus uses strictly necessary session cookies to keep you logged in. These are exempt from consent requirements under § 165 Abs. 3 TKG 2021, as they are necessary to provide the service you explicitly requested. Censopus does not use analytics or advertising cookies.
Recipients and processors
We share data with the following processors, each bound by a data processing agreement under Art. 28 GDPR:
- Stripe — payment processing for Censopus report fees
- Brevo — delivery of transactional emails (e.g. account confirmations, notifications)
- Hetzner — infrastructure hosting for our services
International data transfers
This website and our services are hosted within the EU/EEA, and the processors listed above process data within the EU/EEA as well. As of now, we do not transfer personal data to third countries outside the EU/EEA.
How long we keep data
Account data is kept for as long as your Validopus account is active. If you request deletion of your account, we delete this data within 30 days.
Service data is retained according to that service’s own terms. Currently, Censopus data follows the same rule: kept while your account is active, deleted within 30 days of an account deletion request.
Exception: invoices and payment records must be retained for seven years under Austrian tax law (§ 132 Bundesabgabenordnung), regardless of account status.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data, subject to the retention exception above (Art. 17)
- Restrict processing in certain circumstances (Art. 18)
- Data portability for data you provided us (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at office@validopus.com.
You also have the right to lodge a complaint with the Austrian data protection authority:
- Österreichische Datenschutzbehörde
- Barichgasse 40–42, 1030 Wien, Austria
- Email: dsb@dsb.gv.at
- Phone: +43 1 52 152-0
Changes to this policy
We may update this policy as the service evolves. Material changes will be reflected here with an updated date.