About Us

• Not all companies formally need one. You need a DPO if your core activities involve large-scale processing of personal data or systematic monitoring of individuals. But even if you don't technically need one, most companies we work with appoint a DPO because enterprise customers, investors, and regulators expect it. It comes up in almost every funding round and big deal.

• Depends on your company size, data complexity, and how many regulations you need to cover

• We offer three tiers: Advisory (starting from €500/month), DPO Essentials (starting from €2,000/month), and DPO Premium (starting from €5,000/month). Every engagement is tailored to only what you actually need

• A DPO oversees your data protection compliance and is registered with the supervisory authority

• An EU Representative is for non-EU companies processing EU personal data, acting as a local contact for regulators and data subjects

• You can use the same provider for both

• EU GDPR, UK GDPR

• US state and federal privacy laws (CCPA/CPRA, HIPAA, GLBA, and others)

• Brazil LGPD, Canada PIPEDA

• Thailand PDPA, China PIPL, India DPDPA, Japan APPI, South Korea PIPA

• UAE and Saudi Arabia data protection laws,

• the EU AI Act, NIS2, DORA

• Frameworks like ISO 27001, ISO 27701, SOC 2, and NIST

• Most engagements start within a week.

• Month one is a focused privacy audit, building your core documentation, aligning priorities, and getting registered as your DPO.

• From month two your DPO is fully embedded and handling ongoing compliance, enterprise questionnaires, and anything privacy-related.

• SaaS, HealthTech, Fintech, Crypto, HR Tech, e-Commerce, Retail, Investment and Banking, Healthcare, Medtech, and Pharma

• Our founder has personally led privacy programs at companies from pre-seed startups to Fortune 10 enterprises

1. Have an internal AI policy and use it - this aligns your company's approved and non-approved uses of AI. This helps prevent confidential or personal data being used in AI tools and large-language-model training (not ideal).

2. Assess your product's usage of AI for data quality, system monitoring and logging, and meeting transparency requirements (can you show how you got your results?)
   

3. Certain uses of AI are prohibited, such as AI that can significantly distort a person’s behavior to cause physical or psychological harm, real-time remote biometric identification systems (for law enforcement), and AI designed to exploit vulnerabilities of specific groups of people

Marketing

1. Only advertise or track B2C users or their devices when they have consented to this (some exceptions apply in B2B situations). Always allow people to opt-out.

Product

1. Generally don't use personal data for multiple purposes (i.e. using account data for marketing is not good, since you need consent). Some exceptions include product improvement and analytics

2. Perform a privacy risk assessment to ensure the product’s usage of data is compliant

HR

1. Do not utilize employee data for secondary purposes (i.e. monitoring) - ask for consent

Customer Support:

1. Keep customer notes professional - these may need to be provided to a customer if they ask for it for a copy of them

US and EU laws are similar but with slight differences. Some of which include:

1. California and EU/UK requirements only apply when you are offering services to (or processing data from) people who live there

2. California requires some additional opt-out (selling or sharing data to third-parties), and allows 15 more days to fulfill data subject rights requests

3. The US is mostly accepting of marketing to end-users without their prior consent (this is not compliant in the EU/UK)

4. Cookies: EU/UK requires individuals to opt-in before cookies process data. Otherwise, you can usually allow auto opt-into cookies as long as users can also opt-out.