Legal
How personal data are processed in the complianceofficer.eu Office, under the General Data Protection Regulation.
Direct Hit — Prestação de Serviços de Apoio a Empresas, Lda, tax number PT 504526146, with registered office at Rua Sousa Lopes, 65, 5.º, 1601-301 Lisboa, Portugal, is the controller of the personal data processed in this Office (office.complianceofficer.eu) and through the forms linked from it.
For any question about this notice or to exercise your rights, contact info@complianceofficer.eu.
Office accounts and access to services: name, email address, organisation, access records and learning progress, to provide the services contracted; legal basis: the performance of a contract (Article 6(1)(b) GDPR) or, where the user is a worker of a client organisation, our legitimate interest and that of the client in performing the contract concluded with that organisation (Article 6(1)(f));
requests for proposals, information and assessments: contact and organisation data and the information you provide, to answer your request and prepare a proposal; legal basis: steps taken at your request before entering into a contract (Article 6(1)(b));
regulatory alerts: name and email address, to send the alerts you subscribed to; legal basis: consent (Article 6(1)(a)), which you may withdraw at any time;
help-desk and secretariat communications: the content of your requests, to provide support; legal basis: the performance of a contract (Article 6(1)(b));
invoicing and accounting: billing data, to comply with tax and accounting obligations; legal basis: legal obligation (Article 6(1)(c));
platform security: technical logs, to keep the Office secure; legal basis: legitimate interest (Article 6(1)(f)).
We do not use your data for automated decision-making or profiling with legal or similarly significant effects, and we apply data minimisation: the Office processes only the data needed to give access to the services.
Your data are processed by service providers acting on our behalf, under written data processing agreements, in particular:
Podia: the platform that hosts this Office, user accounts, courses and service emails;
Jotform: the online forms used for requests, assessments and subscriptions;
payment and invoicing providers: where applicable, to process payments and issue invoices.
Data may also be disclosed to public authorities when required by law.
Some providers are established, or process data, outside the European Economic Area, in particular in the United States. Such transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified under it, or on the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).
Office accounts and training records: for the duration of the contract and, thereafter, for the period needed to evidence the training provided, as agreed with the client organisation;
requests that do not lead to a contract: up to two years;
regulatory alerts: until you unsubscribe;
invoicing and accounting records: for the period required by tax law, currently ten years in Portugal.
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and, where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of prior processing. You may also lodge a complaint with the Portuguese data protection authority, the CNPD, or with the supervisory authority of your Member State.
See the Cookie Policy.
We may update this notice to reflect changes in our services or in the law. The current version is always available on this page.
Last updated: October 2026.