Legal
How CompliScan collects, uses, and protects information as Clients certify vendors, Vendors get certified, and documents are read, graded, and renewed.
Your trust matters to us. This Privacy Policy describes the information CompliScan handles across compliscan.com and the Client and Vendor applications, why we process it, who we share it with, and the choices and rights you have. Because CompliScan is a platform that connects Clients and Vendors, please note where a Client — not CompliScan — controls the data you provide.
This Privacy Policy explains how CompliScan ("CompliScan," "we," "us," or "our") collects, uses, shares, and protects information in connection with the CompliScan websites (including compliscan.com), applications, and services (together, the "Service").
CompliScan operates a vendor risk-management and certification platform: Clients define the requirements and pricing their Vendors must meet, Vendors submit documents and pay a fee to become certified, and the platform reads, grades, tracks, and renews compliance documents, issues verifiable certificates, and credits rewards. This Policy applies to our marketing site and to the Client and Vendor applications, and should be read together with our Terms of Use.
Our role depends on the data in question:
If you are a Vendor and wish to exercise rights over data you submitted to a Client, please also contact that Client.
We use information to:
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you or your organization request); our legitimate interests (operating, securing, and improving the Service and conducting business-to-business marketing); your consent where required (for example certain cookies or marketing); and compliance with legal obligations. Where we act as a processor for a Client, the Client is responsible for the legal basis of its processing.
Certification Fees and reward payouts are handled by third-party payment providers. Your payment details are processed under those providers' terms and privacy policies. CompliScan does not receive or store full payment-card numbers; we retain only limited transaction metadata needed for records, accounting, and the Rewards ledger.
We use cookies and similar technologies for essential functions — such as keeping you signed in and maintaining your session — and, where applicable, to understand and improve how the Service is used. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.
Because Vendors may submit sensitive materials — for example tax forms containing identification numbers, background-check results, or financial information — we restrict access to such data, log activity through our audit trail, and process it only to deliver certification, grading, and related services. Vendors should submit only the information a Client requires and that they are authorized to share.
We retain information for as long as needed to provide the Service, maintain certification history and audit logs, comply with legal and accounting obligations, resolve disputes, and enforce our agreements. For Client-controlled data, retention also follows the Client's instructions and our agreement. When information is no longer needed, we delete or de-identify it.
We use technical and organizational safeguards designed to protect information, including encryption in transit, access controls, role-based permissions, and append-only audit logging. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
The Service is operated in the United States, and our infrastructure is hosted on Amazon Web Services (primarily in the United States). If you access the Service from outside the United States, you understand that your information will be processed in the United States and potentially other locations whose data-protection laws may differ from those of your jurisdiction.
Depending on where you live, you may have rights to access, correct, delete, port, or restrict or object to the processing of your personal information, and to withdraw consent. To exercise these rights, contact us at privacy@compliscan.com. If your information was submitted to a Client (for example as a Vendor), please also contact that Client, who controls that data.
We honor applicable privacy laws, including the GDPR/UK GDPR and the CCPA/CPRA. We do not sell personal information or use it for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.
You can opt out of marketing emails at any time by using the unsubscribe link in those messages or by contacting us. Even if you opt out of marketing, we may still send necessary service and transactional messages, such as certification reminders, renewals, and security notices.
The Service is intended for business use and is not directed to children under 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can remove it.
The Service may link to or integrate with third-party services, such as payment, identity, or document providers. We are not responsible for the privacy practices of those third parties, which are governed by their own policies.
We may update this Privacy Policy from time to time. If we make material changes, we will indicate this by updating the "Last updated" date below and, where appropriate, by providing additional notice. Your continued use of the Service after an update means you accept the revised Policy.
Questions about this Policy or your information? Contact us at privacy@compliscan.com.
By using CompliScan you acknowledge that you have read and understood this Privacy Policy.
Welcome back
Choose your account type and we'll take you to the right sign-in.