Privacy Policy

Version 2.0 · Effective 9 September 2026

1. Who we are

Complidata NV is the data controller for the personal data described in this policy.

Ildefonse Vandammestraat 5, 1560 Hoeilaart, Belgium Enterprise number 0693.755.579 · VAT BE0693755579

• Privacy enquiries and rights requests: privacy@complidata.io

• General: info@complidata.io · +32 479 01 87 51

• 
  

2. What this policy covers

This policy explains how we handle personal data about people who visit our website, contact us, request a demo, subscribe to our communications, meet us at an event, or apply to work with us — whether that contact happens online, by email, or in person.

It does not cover personal data contained in the trade finance and compliance data our clients process through TradeSpeed and FCRR. For that data we act as a processor on our clients' instructions, and the client's own privacy notice and our data processing agreement govern it. If you believe your data was processed through one of our products, please contact the financial institution you deal with.

3. What we collect, why, and on what basis

Information you give us

• Contact and demo requests — first and last name, business email, company, job title and anything in your message. Purpose: responding to you and evaluating whether our products fit your needs. Basis: steps taken at your request prior to a contract (Art. 6(1)(b)), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)).

• Newsletter and gated content — name and email, plus company and job title for gated material. Purpose: sending you the content and our newsletter. Basis: your consent (Art. 6(1)(a)), or our legitimate interest in marketing to existing contacts where permitted.

• Meeting bookings — name, email, timezone and meeting details, collected through Calendly. Basis: steps at your request prior to a contract.

• Events — contact details you share at conferences and trade shows, including badge scans where you consent to them. Basis: consent, or legitimate interest in business development.

• Job applications — your CV, cover letter, contact details, work history and anything else you send us. Basis: steps prior to an employment contract, and our legitimate interest in assessing candidates.

  
  

Information we collect automatically

• Server logs — our website is hosted by Wix, which records technical log data including IP address, browser and device type, referring and exit pages and timestamps in order to deliver and secure the site. We treat IP addresses as personal data. Purpose: security, troubleshooting and site administration. Basis: legitimate interest in operating a secure website. Wix determines how long these logs are kept and we do not have direct access to or control over them — see section 8.

• Analytics and behavioural measurement — described in section 5. Basis: your consent.

• Error and performance monitoring — Sentry records technical error data including IP address and user agent when something breaks. Basis: legitimate interest in a working website.

Providing your details on our forms is not a statutory requirement. It is necessary if you want us to respond, and we cannot process a demo request or an application without it.

4. Who we share it with

We do not sell personal data. We share it with:

• Website and forms — Wix.com Ltd (hosting, forms, blog, email campaigns)

• Analytics and behaviour — Google (Google Analytics 4), Microsoft Ireland Operations Ltd (Clarity session replay and heatmaps)

• Visitor identification and sales intelligence — Apollo.io

• Error monitoring — Functional Software, Inc. (Sentry)

• Scheduling — Calendly LLC

• Pipedrive — Sales CRM 

• Professional advisers — lawyers, auditors and accountants, where necessary

• Authorities — where we are legally required to disclose

Each processor is bound by a written agreement restricting them to our instructions. A current list of processors is available on request.

5. Cookies and similar technologies

We use cookies and similar technologies that fall into four groups:

• Strictly necessary — security and session management so the site works. These do not require consent.

• Analytics — Google Analytics 4, to understand which pages are useful.

• Behavioural measurement — Microsoft Clarity, which records how visitors move, scroll and click, and lets us replay a session to see where a page confuses people. Form fields are masked.

• Sales intelligence — Apollo.io, which uses a persistent identifier to recognise return visits and helps us identify the organisations interested in our products.

Everything other than strictly necessary cookies is set only after you consent through our cookie banner. You can change or withdraw your choices at any time through the cookie settings link in our footer, and withdrawing is as easy as giving consent.

6. Marketing

We send commercial email only where you have opted in, or where you are an existing business contact and the message relates to products similar to those you have already discussed with us. Every email carries a one-click unsubscribe, and unsubscribing removes you from all marketing lists. Our postal address appears in every commercial message. Withdrawing marketing consent does not affect our answering your enquiries.

7. Profiling

We score and prioritise business leads using the information described above, including data from Apollo.io. This helps our team decide who to contact and what to talk about. It produces no legal effect and nothing similarly significant for you, and we make no automated decisions of that kind. You can object to this profiling at any time using the contact details in section 1.

8. How long we keep it

• Enquiries and demo requests that do not become a relationship — 24 months from last contact

• Marketing contacts — until you unsubscribe, then on a suppression list so we do not contact you again

• Client and prospect records forming part of a commercial relationship — the relationship plus 5 years

• Hosting and security logs — held by Wix, our hosting provider, which determines the period based on what is necessary for delivery, security, troubleshooting and its own legal obligations. We do not have direct access to or control over these logs. See Wix's privacy policy and our data processing agreement with them.

• Google Analytics — 2 months, as set in our Analytics property

• Microsoft Clarity — 30 days for session recordings, 9 months for heatmaps and aggregated click data, as fixed by Microsoft and not configurable by us

• Apollo.io — Apollo publishes no in-life retention period and applies a “consistent with the purposes for which it was collected” standard. Under its data processing agreement we may require deletion or return of our customer personal data within 90 days of that agreement ending, with backup copies aging out on Apollo's normal data lifecycle. Data held in Apollo's own business contact database is retained by Apollo as controller under its own policy.

Where a legal, accounting or regulatory obligation requires longer, we keep it for that period and no longer.

9. International transfers

Some of our providers are established outside the EEA, principally in the United States. Where we transfer personal data outside the EEA or the UK, we rely on an adequacy decision where one applies, the EU–US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses together with a transfer impact assessment and any supplementary measures needed. You can request a copy of the safeguards for any transfer at privacy@complidata.io.

10. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit, access control on a need-to-know basis, logging, supplier due diligence and staff training. No system is perfectly secure, and we will notify you and the supervisory authority where a breach requires it.

11. Your rights

If you are in the EEA, the UK or Switzerland

You have the right to access your data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, withdraw consent at any time, and object to direct marketing at any time with no justification needed.

We answer within one month and free of charge. We may extend by two further months for complex requests, and will tell you if we do. We may charge a reasonable fee only for additional copies, or refuse a request that is manifestly unfounded or excessive, giving reasons.

You can complain to the Belgian Data Protection Authority — Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be — or to the authority where you live or work. In the UK, the Information Commissioner's Office. In Switzerland, the Federal Data Protection and Information Commissioner. We would rather you came to us first.

If you are in the United States

Depending on your state, you may have the right to know what we collect, to access, correct or delete it, to receive a copy, to opt out of targeted advertising, sale or sharing, and to be free from discrimination for exercising these rights. We do not sell personal information for money. Our use of analytics and sales-intelligence tools may constitute "sharing" or a "sale" under some state laws; you can opt out through our cookie banner or by emailing privacy@complidata.io, and we honour Global Privacy Control signals where we receive them. You may appeal a refused request by replying to our decision. An authorised agent may act for you with proof of authority.

Other regions

If your local law gives you rights beyond those above — including under Singapore's PDPA, the UAE and DIFC data protection laws, and other regimes where we do business — we will honour them. Contact us and we will apply whichever standard gives you the most protection.

We may need to verify your identity before acting, and will ask for no more information than necessary to do so.

12. Children

Our website and products are for financial institutions and business users. We do not direct them at children and do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

13. Changes

This is version 2.0, effective 9 September 2026. We update this policy when our processing changes. Material changes are announced on this page at least 14 days before taking effect, and we email registered contacts where the change materially affects them. Previous versions are available on request.