Privacy Policy

Privacy Policy

Last updated: 6 October 2026

1. Scope

This Privacy Policy explains how personal data is processed in connection with the ComplyEdge website, the ComplyEdge software platform and related services.

ComplyEdge is a brand of BLUVIT GmbH.

This Privacy Policy applies in particular to:

• visitors to complyedge.de;

• persons who contact us or request a demo;

• users of the ComplyEdge platform;

• customer administrators and other authorised users;

• supplier and manufacturer contacts receiving requests through ComplyEdge;

• users of supplier portals and document-sharing functions;

• persons whose personal data is contained in documents or other customer content processed through ComplyEdge.

Where a ComplyEdge customer uses the platform to process personal data for its own business purposes, BLUVIT GmbH generally acts as a processor on behalf of that customer. In those cases, the customer remains the controller and the processing is additionally governed by a Data Processing Agreement pursuant to Article 28 GDPR.

2. Controller

For processing for which BLUVIT GmbH determines the purposes and means, the controller is:

BLUVIT GmbH
Obergarten 22
34253 Lohfelden
Germany

Telephone: +49 561 9402 6666
E-mail: info@bluvit.de

For ComplyEdge-related enquiries you may also contact:

info@complyedge.de

Operational office:

Am alten Rathaus 5a
34253 Lohfelden
Germany

3. General principles

We process personal data only where this is necessary for clearly defined purposes and where a lawful basis exists.

Depending on the processing activity, the legal basis may include:

• Article 6(1)(a) GDPR – consent;

• Article 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract;

• Article 6(1)(c) GDPR – compliance with legal obligations;

• Article 6(1)(f) GDPR – legitimate interests.

Where we rely on legitimate interests, these may include in particular:

• operating and securing our website and platform;

• preventing misuse and cyber attacks;

• responding to business enquiries;

• maintaining reliable audit trails;

• operating a secure B2B software service;

• improving the technical reliability of our services.

4. Visiting our website

When you access complyedge.de, technical information may automatically be processed by our systems and hosting infrastructure.

This may include:

• IP address;

• date and time of access;

• requested URL or resource;

• referrer URL;

• browser type and version;

• operating system;

• device information;

• HTTP status and response information;

• transferred data volume;

• technical error and security information.

The purpose of this processing is to:

• provide the website;

• ensure stability and security;

• identify technical faults;

• prevent abuse and attacks;

• investigate security incidents.

The legal basis is Article 6(1)(f) GDPR.

Technical log data is retained only for as long as required for operation, security, troubleshooting and incident investigation and is subsequently deleted or anonymised unless further retention is necessary for a specific security incident or legal obligation.

5. Hosting and infrastructure

The ComplyEdge website and core ComplyEdge platform are operated using infrastructure in Germany.

We use services of:

IONOS Cloud GmbH
Elgendorfer Straße 57
56410 Montabaur
Germany

IONOS is used, depending on the service component, for infrastructure including:

• compute and Kubernetes infrastructure;

• databases;

• object storage;

• network services;

• monitoring infrastructure;

• e-mail transport.

Where IONOS processes personal data on our behalf, this processing takes place under a data processing arrangement in accordance with Article 28 GDPR.

Customer environments may be technically separated from other customer environments.

6. Demo requests

When you request an IHM Readiness Demo through our website, we currently request information including:

• first name;

• last name;

• business e-mail address;

• company;

• vessels or items in scope;

• procurement data source;

• information about the current MD/SDoC process;

• reason for your current interest;

• optional message.

We process this information to:

• respond to your request;

• understand your requirements;

• prepare a relevant demonstration;

• assess an appropriate pilot or implementation approach;

• communicate with you regarding a possible business relationship.

Where the request relates directly to the initiation of a contract with you, the legal basis is Article 6(1)(b) GDPR.

For business enquiries made on behalf of a company or organisation, processing may additionally or alternatively be based on Article 6(1)(f) GDPR. Our legitimate interest is the handling of business enquiries and the establishment of business relationships.

The information is retained for the duration necessary to process the enquiry. Where a business relationship is established, relevant information may subsequently be retained as part of the contractual relationship and in accordance with applicable statutory retention obligations.

7. Contact by e-mail, telephone or other means

If you contact us directly, we process the information provided by you, which may include:

• name;

• company;

• e-mail address;

• telephone number;

• position or organisational role;

• contents of the communication;

• documents or attachments provided by you.

The processing serves to respond to and manage your enquiry.

Depending on the context, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.

8. Cookies, local storage and similar technologies

The public ComplyEdge website does not require advertising or behavioural tracking in order to provide its core functionality.

Technically necessary cookies or comparable storage mechanisms may be used where required to provide requested functions, protect the service or maintain technical session information.

The ComplyEdge application may use technically necessary browser storage, including local or session storage, for functions such as:

• authentication and session handling;

• security state;

• user interface preferences;

• navigation preferences;

• returning users to previously visited platform areas.

Where access to or storage of information on a user’s device is strictly necessary to provide a service requested by the user, such use is based on the applicable provisions of Section 25 TDDDG.

Where optional analytics, advertising or similar technologies requiring consent are introduced, they will only be activated in accordance with the applicable consent requirements and this Privacy Policy will be updated accordingly.

9. User accounts and authentication

ComplyEdge uses an identity and access management system based on Keycloak.

For authorised platform users, we may process:

• user ID;

• username;

• first name;

• last name;

• e-mail address;

• account status;

• assigned roles and permissions;

• organisation or customer association;

• authentication and security information.

The purpose is to:

• create and administer user accounts;

• authenticate users;

• enforce role-based access control;

• protect customer environments;

• manage invitations and password setup;

• prevent unauthorised access.

The legal basis is Article 6(1)(b) GDPR where the processing is necessary to provide the contractual service and Article 6(1)(f) GDPR for security, access control and misuse prevention.

Authentication infrastructure is operated as part of the ComplyEdge environment.

10. Platform usage, security and audit logs

When the ComplyEdge platform is used, technical and audit information may be recorded.

Depending on the function used, this may include:

• user ID;

• user name;

• e-mail address;

• IP address;

• date and time;

• action performed;

• affected project, document or object;

• success or failure of an action;

• reason or error information;

• access history;

• security-relevant events.

Such information is used to:

• secure the platform;

• provide traceability;

• investigate incidents;

• demonstrate access and processing history;

• detect misuse;

• fulfil customer compliance requirements;

• support technical troubleshooting.

The legal basis for processing performed by BLUVIT for its own security purposes is Article 6(1)(f) GDPR.

Where audit data is generated as part of customer-controlled processing, BLUVIT processes such information as processor on behalf of the customer.

11. Customer data processed through ComplyEdge

Customers may use ComplyEdge to store and process information relating to:

• vessels;

• projects;

• orders and order items;

• suppliers and manufacturers;

• Material Declarations;

• Supplier’s Declarations of Conformity;

• IHM records;

• technical documentation;

• reports;

• audit evidence;

• files and attachments;

• user assignments and responsibilities.

Such business information may contain personal data, for example:

• names of customer employees;

• names of supplier contacts;

• business e-mail addresses;

• signatures;

• names appearing in declarations or certificates;

• uploaded documents containing personal information;

• information about users performing reviews or approvals.

For this category of processing, the respective ComplyEdge customer generally determines why the information is processed.

The customer therefore acts as controller and BLUVIT GmbH acts as processor pursuant to Article 28 GDPR.

We process such data only:

• according to the customer’s documented instructions;

• for the provision of the ComplyEdge service;

• for security and technical operation;

• as otherwise permitted or required by applicable law.

Customers are responsible for ensuring that they have a lawful basis for the personal data uploaded to or processed through ComplyEdge.

12. Suppliers and supplier portal

ComplyEdge supports automated supplier communication and supplier documentation workflows.

A customer may provide us with supplier information such as:

• supplier company name;

• business e-mail address;

• relevant order or item information;

• documentation request information.

ComplyEdge may then send automated requests, reminders or access links on behalf of the customer.

Supplier portal access may be provided through unique access tokens without requiring creation of a full platform account.

Information submitted through a supplier portal may include:

• Material Declarations;

• SDoCs;

• other compliance documents;

• associated file metadata;

• information required to associate documents with orders, products or requests.

In such cases, BLUVIT generally acts as processor on behalf of the customer that initiated the request.

The customer remains responsible for the legal basis for contacting the supplier and for providing any information required under Articles 13 or 14 GDPR.

13. E-mail notifications

ComplyEdge uses e-mail for purposes including:

• user invitations;

• password setup;

• supplier requests;

• reminders;

• workflow notifications;

• service-related communications.

E-mail delivery is performed using configured SMTP infrastructure.

The information processed may include:

• recipient e-mail address;

• recipient name where available;

• message contents;

• information required to associate the communication with the relevant workflow.

E-mail communications are not used for unrelated advertising unless a separate legal basis exists.

14. Documents and object storage

Documents uploaded to ComplyEdge are stored in object storage associated with the relevant customer environment.

File-related metadata may include:

• file name;

• file type;

• file size;

• upload time;

• uploading user;

• document type;

• version history;

• validation or review information;

• related vessel, order, project or supplier.

ComplyEdge applies access controls to restrict document access to authorised users and workflows.

15. Generation of PDF reports

For the generation of certain IHM Maintenance and MD Management reports, ComplyEdge may use the external document-generation service PDFMonkey.

For this purpose, report data required to generate the selected report is transmitted to PDFMonkey.

Depending on the report, this may include:

• report content;

• project-related information;

• vessel and compliance information;

• file name and report metadata;

• information contained in the report which may in individual cases include personal data.

PDFMonkey generates the requested document and makes it temporarily available to ComplyEdge. The generated report is subsequently transferred to ComplyEdge’s own object storage.

PDFMonkey states that its document-generation infrastructure is hosted in the European Union, including infrastructure in the Paris region.

PDFMonkey stores submitted document payloads and generated documents in accordance with the retention period configured for the respective template. Such retention is limited to the period required for document generation, retrieval and technical troubleshooting.

Where PDFMonkey processes personal data for ComplyEdge, it acts as a processor or subprocessor under an appropriate data processing arrangement.

16. Secure Data module

Where the optional Secure Data module is enabled, additional processing may take place depending on the customer’s configuration.

This may include:

• protected document storage;

• file versions;

• classifications;

• export-control metadata;

• access permissions;

• user memberships;

• file hashes;

• audit trails;

• sharing information;

• access information;

• security events.

Secure Data audit events may include:

• platform user ID;

• display name;

• e-mail address;

• IP address;

• country code;

• action performed;

• affected object;

• timestamp;

• outcome and reason information.

Where the Secure Data assistant function is enabled, the system may additionally store:

• user ID;

• question entered by the user;

• generated answer;

• document references used for the answer;

• timestamp.

These records are used to maintain traceability, security and auditability of the Secure Data environment.

Retention periods for Secure Data may be configured according to customer requirements, including retention periods of five, seven or ten years.

Where Secure Data contains customer-controlled personal data, BLUVIT acts as processor on behalf of the customer.

17. Recipients and service providers

Personal data may be made available to service providers only where this is necessary for providing or securing the service.

Relevant categories of recipients may include:

• cloud hosting providers;

• database and storage providers;

• e-mail infrastructure providers;

• PDF/document generation providers;

• technical support providers;

• security and monitoring service providers;

• professional advisers where legally necessary;

• authorities where disclosure is required by law.

Current key infrastructure providers include in particular:

IONOS Cloud GmbH
for hosting, cloud infrastructure, storage and related technical services.

PDFMonkey
where enabled for PDF report generation.

We do not sell personal data.

18. Transfers outside the European Economic Area

The core ComplyEdge platform is designed to process customer data on infrastructure located in Germany.

PDFMonkey states that its document-generation infrastructure and storage are located in the European Union.

Where a service provider or its subprocessor nevertheless involves a transfer to a country outside the European Economic Area, such transfer will only take place where the requirements of Chapter V GDPR are met.

Depending on the recipient, this may include:

• an adequacy decision under Article 45 GDPR;

• Standard Contractual Clauses under Article 46 GDPR;

• other legally recognised safeguards.

19. Retention and deletion

We do not retain personal data for longer than necessary for the applicable purpose.

The specific retention period depends on the category of data.

Website and security data

Retained for the period required to provide and secure the service and investigate technical or security incidents.

Demo and contact enquiries

Retained for as long as necessary to handle the enquiry and any resulting business relationship.

Contract and account information

Retained for the duration of the contractual relationship and subsequently where required by applicable legal retention obligations.

Customer content

Retained in accordance with the customer’s instructions, contractual arrangements and applicable Data Processing Agreement.

Secure Data

Retention may be configured by the customer, including five-, seven- or ten-year retention periods.

Backup copies

Deleted data may remain in technically necessary backup copies until the relevant backup cycle expires. Backup copies are not used for ordinary operational processing after deletion from the live system.

20. Data security

We use appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;

• accidental or unlawful disclosure;

• alteration;

• loss;

• destruction;

• misuse.

Measures include, depending on the relevant service:

• encrypted network communication;

• access controls;

• role-based permissions;

• customer separation;

• authentication and authorisation controls;

• security logging;

• audit trails;

• backup and recovery mechanisms;

• infrastructure monitoring;

• software and vulnerability management.

No system can guarantee absolute security. Security measures are therefore reviewed and adapted based on risk and technological development.

21. Automated decision-making

ComplyEdge does not use solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning a person or similarly significantly affects that person.

Automated workflow, categorisation, reminder, document-processing or assistant functions support users but do not constitute such automated individual decision-making.

22. Your rights

Subject to the applicable legal requirements, you have the following rights regarding your personal data:

• Right of access – Article 15 GDPR;

• Right to rectification – Article 16 GDPR;

• Right to erasure – Article 17 GDPR;

• Right to restriction of processing – Article 18 GDPR;

• Right to data portability – Article 20 GDPR;

• Right to object – Article 21 GDPR.

Where processing is based on consent, you may withdraw your consent at any time with effect for the future pursuant to Article 7(3) GDPR.

Where BLUVIT acts only as processor on behalf of a ComplyEdge customer, requests relating to customer-controlled data should normally be directed to the relevant customer as controller. We will support our customers in responding to data-subject requests as required under Article 28 GDPR.

To exercise your rights in relation to processing for which BLUVIT GmbH is the controller, contact:

info@complyedge.de

or

info@bluvit.de

23. Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.

We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless processing is required for the establishment, exercise or defence of legal claims.

24. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for BLUVIT GmbH is:

The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany

Telephone: +49 611 1408-0
E-mail: poststelle@datenschutz.hessen.de

You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence or place of work.

25. Changes to this Privacy Policy

We may update this Privacy Policy where:

• our services change;

• new processing activities are introduced;

• service providers change;

• legal requirements change.

The current version is published on complyedge.de.

Last updated: 6 October 2026