We will assign a personal Data Protection Officer (DPO) to you and send you the official certificate of appointment, as well as provide you with access data to our DataGuard web-platform. You will then sign the certificate of appointment and provide us with basic information such as contact persons within your company. We will then prepare the data protection audits, provide the privacy policy for your website, and conduct the employee training courses. Additionally, it will be necessary for you to forward your DPO’s contact details to the relevant supervisory authority. Please refer to the diagram on our website to view the full journey.

The contract can start on the 1st or 15th of each month.

The contract period is 24 months. The contract may be terminated with an advance notice of 6 months prior to the end of the contract period.

Yes, you can upgrade a package during the contract period without extending the length of the contract period. However, please note that a downgrade is not possible.

You can book individual sessions for 180 € per hour at any time. However, the privacy needs of your company and therefore, the appropriate package would have been determined during the initial consultation. In other words, the number of consultation hours is generally sufficient.

If necessary, you may upgrade your service package at any time.

Personal consultation and support + platform/software support:

An interdisciplinary team of lawyers, computer scientists, engineers, business economists etc. supports our customers in teams of 2-4 TÜV/DEKRA certified Data Protection Officers who specialize in the fields of data protection and IT security. As our platform/software is used extensively, we do not consider ourselves a consultancy but a legal-technology company with an approach that is scalable both in Germany and internationally.

The personalized consultation of our customers is supported by a specially programmed web platform. It digitizes and automates manual and repetitive processes using machine learning and processes data input with machine learning, amongst other things. The platform is used by our customers and our team. In June 2018, we filed a patent for our invention with the European Patent Office under reference number Q0144EP.

We cater to customers nationwide and throughout Europe. Communication takes place primarily via e-mail, phone, as well as on our own specially developed web-platform so that we may advise you anywhere and at any time.

In a continuous exchange, we will work together via an intelligent web platform. The platform is intuitively comprehensive and has no barriers to usability. All information related to your company’s data protection can be accessed at any time via a dashboard. Our platform is, of course, subject to the highest security standards. All information is protected against unauthorised access via a trusted cloud. Our cloud not only complies with applicable security regulations but also maintains our own high standards of IT and data security.

No. What’s important is that the Data Protection Officer has all the necessary information needed to fulfil their tasks and that they can be directly contacted by the company’s management team, employees, customers as well as by the authorities. We offer all of these services as we can be contacted directly via telephone or email Monday-Friday, 8AM-6PM. The advantage here is that you can avoid on-site scheduling allowing you and your employees to focus on your operational needs.

Data protection of course! The idea that each and every person expects their data to be handled responsibly.

If a company constantly employs at least ten persons who deal with the automated processing of personal data, the appointment of a DPO is mandatory according to German data protection law. This also includes external service providers such as an external accounting department.

If a company carries out out processing which is subject to a data protection impact assessment or processes personal data for business purposes for the transmission / anonymised transmission of personal data, or for the purposes of marketing or opinion research, then a DPO must be appointed, regardless of how many employees are involved in the processing of personal data.

Many companies prefer to name a DPO internally from their existing workforce. However, there are important qualifications that must be considered when designating a DPO.

A DPO must have the following competencies:

• Expert knowledge of relevant data protection law: GDPR and national laws (BDSG, TMG, TKG)
• Legal understanding
• Extensive technical expertise
• Knowledge of the IT basic protection catalogues of the Federal Office for Information Security (BSI)
• Ideally, relevant data protection certifications
• Reliability and personal integrity

The following individuals may not be designated as Data Protection Officers:

• Managing Directors or General Managers
• Senior Management (especially management of the IT department)
• Unqualified or insufficiently experienced persons

The legislative intent of these restrictions is to avoid potential conflicts of interest and possible sources of error.

A violation could result in fines of up to €20 million or up to 4% of the total worldwide annual turnover of the previous financial year, whichever is higher. Many violations including the non-appointment of a Data Protection Officer, are considered grossly negligent behaviour. Directors may be held personally liable with their private assets.

It took less than half a year for the first company to suffer the consequences of the GDPR: The Karlsruhe-based, provider, Knuddels, was fined €20,000 for a security breach. The grace period for companies has expired with the first round of enforcement. Now, supervisory authorities are vigilantly following-up on infringements.