Privacy Policy

This Privacy Policy explains how Skylen Solutions ApS, trading as the brand ComplyTrain (“ComplyTrain”, “Skylen Solutions”, “we”, “us”, or “our”), collects, uses, and protects personal data when you visit our website at complytrain.net, communicate with us, register for or use the ComplyTrain platform, or otherwise interact with us as a business contact. We are committed to processing personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the Danish Data Protection Act (Databeskyttelsesloven).

Scope. This Policy describes the processing for which we act as a data controller - for example website usage data, enquiries, account registration data, and marketing contacts. Where we process personal data contained in customer content on the ComplyTrain platform, we act as a data processor on behalf of our customers; that processing is governed by our Data Processing Addendum (“DPA”) and the customer’s own privacy notices, not by this Policy (see Section 12).

1. Who we are and how to contact us

The data controller responsible for your personal data is Skylen Solutions ApS, a company registered in Denmark under CVR no. 45855287, with its registered office at Vesterbrogade 1L, 2. (Industriens Hus), 1620 Copenhagen V, Denmark.

For any question about this Policy or your personal data, contact us at contact@skylen.com. Our full contact details are in Section 16.

2. The personal data we collect

2.1 Data you provide to us

• Identity and contact data - name, job title, employer/organisation, business email address, and telephone number.
• Account data - username and authentication credentials (passwords are stored in hashed form), and account settings.
• Enquiry and support data - the content of messages, demo or sales requests, and support correspondence you send us.
• Marketing data - your preferences for receiving communications from us.
• Billing data - billing contact, organisation address, and VAT number. Card payments are handled by our payment provider; we do not store full card numbers.

2.2 Data we collect automatically

• Usage data - pages and features viewed, actions taken, and dates and times of access.
• Technical and device data - IP address, browser type and version, operating system, and device identifiers.
• Cookie data - information collected through cookies and similar technologies (see Section 4).

2.3 Data from third parties

We may receive limited business-contact information from sources such as referrals and introductions, publicly available professional sources, and our customer-relationship and marketing tools.

Special category data. We do not seek to collect special categories of personal data (such as health, political, or biometric data) through our website or business contacts. Please do not send us such data unless specifically requested.

3. How we use personal data and our legal bases

We use personal data only where we have a lawful basis under Article 6 GDPR. The purposes below summarise how we use personal data and the corresponding legal bases.

• Operating our website and responding to enquiries - contact data, enquiry content, and usage data. Legal basis: legitimate interests, and steps taken prior to entering a contract.
• Creating and administering accounts and providing the platform - account data and usage data. Legal basis: performance of a contract.
• Billing, invoicing and collecting payment - billing data and transaction records. Legal basis: performance of a contract, and legal obligation.
• Sending service and administrative messages - account and contact data. Legal basis: performance of a contract, and legitimate interests.
• Sending marketing communications and newsletters - identity, contact and marketing data. Legal basis: consent, or legitimate interests for existing customers.
• Measuring and improving our website and services - usage, technical and cookie data. Legal basis: consent for non-essential cookies, and legitimate interests.
• Security, fraud prevention and platform integrity - usage, technical and log data. Legal basis: legitimate interests, and legal obligation.
• Complying with legal, accounting and tax obligations - the relevant records. Legal basis: legal obligation.
• Establishing, exercising or defending legal claims - relevant data as necessary. Legal basis: legitimate interests.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing (see Section 10). Where we rely on consent, you may withdraw it at any time.

4. Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember your preferences, and understand how the site is used. Non-essential cookies (such as analytics and marketing cookies) are set only with your consent, which you give through our cookie banner and can change at any time.

The categories we use are:

• Strictly necessary - enable core site functions and security. These cannot be switched off and do not require consent.
• Functional - remember your choices and preferences. Set only with your consent.
• Analytics - help us understand and improve site usage. Set only with your consent.
• Marketing - measure campaigns and deliver relevant content. Set only with your consent.

5. Marketing communications

We may send you information about our services, events, and updates where you have consented or where you are an existing customer and applicable law permits. Every marketing email includes an easy way to unsubscribe, and you can opt out at any time by contacting us. Opting out of marketing does not stop essential service or administrative messages relating to your account.

6. How we share personal data

We share personal data only as necessary and with appropriate safeguards. Recipients may include:

• Service providers and sub-processors - who help us run our website and platform, such as hosting, analytics, email and CRM, and payment providers. These parties act under contract and may process personal data only on our instructions.
• Professional advisers - such as lawyers, accountants, auditors, and insurers, where necessary.
• Authorities and regulators - where required by law, court order, or a lawful request.
• Business transfers - in connection with a merger, acquisition, or sale of assets, in which case personal data may be transferred subject to this Policy.

We do not sell your personal data. We maintain a current list of sub-processors used to deliver the ComplyTrain platform, which is available on request at contact@skylen.com; changes are handled in accordance with our DPA.

7. International transfers

The ComplyTrain platform is hosted and processed within the European Economic Area (EEA). Where any personal data is transferred to a country outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR - typically the European Commission’s Standard Contractual Clauses - so that your data continues to receive an adequate level of protection. You may request further information about these safeguards using the contact details in Section 16.

8. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Policy, after which it is deleted or anonymised. In determining retention periods we consider the nature of the data, the purpose, and any legal or contractual requirements. As guidance:

• Account and relationship data - for the duration of the customer relationship and a reasonable period afterwards.
• Enquiry and marketing data - until you opt out or the data is no longer needed for the purpose collected.
• Accounting and transaction records - retained for five (5) years in accordance with the Danish Bookkeeping Act (Bogføringsloven).

9. How we protect personal data

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include access controls, encryption in transit, logging, and staff confidentiality obligations. No system is completely secure, but we work to protect your data and to notify you and the relevant authority of any personal data breach where required by law.

10. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing, including direct marketing;
• receive certain data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal; and
• lodge a complaint with a supervisory authority (see Section 16).

To exercise any of these rights, contact us at contact@skylen.com. We will respond within the timeframes required by the GDPR and may need to verify your identity.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing in the course of operating our website or business contacts. Where the ComplyTrain platform applies AI-assisted features to customer content, that processing is carried out on behalf of our customers under the DPA and remains subject to human oversight by the customer.

12. Customer content and our role as processor

When our customers upload documents and other content to the ComplyTrain platform, that content may contain personal data. In relation to such data we act as a data processor, and the customer is the data controller. We process it only on the customer’s documented instructions, as set out in our Data Processing Addendum entered into under Article 28 GDPR. If your personal data appears in a customer’s account and you wish to exercise your rights, please contact that customer (the controller); we will assist them as required under the DPA.

13. Third-party links

Our website may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy notices.

14. Children and non-consumer use

Our website and the ComplyTrain platform are intended for organisations and professional users and are not directed at children or at consumers as defined under EU consumer protection law. We do not knowingly collect personal data from children under the age of 18.

15. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or through the Service. Your continued use of our website or the Service after the effective date constitutes acknowledgement of the updated Policy.

16. Contact us and how to complain

Skylen Solutions ApS (trading as ComplyTrain)

Vesterbrogade 1L, 2. (Industriens Hus), 1620 Copenhagen V, Denmark. Email: contact@skylen.com · VAT: DK 45855287.

Supervisory authority. If you have concerns about how we handle your personal data, we encourage you to contact us first. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark - dt@datatilsynet.dk, +45 33 19 32 00, www.datatilsynet.dk.