Compenio

Privacy policy

Co-funded by the European Union. This project is co-financed from tax revenues on the basis of the budget adopted by the Saxon State Parliament.

1. Controller

Compenio GmbH, Franziska-Tiburtius-Straße 1, 01326 Dresden, Germany
Email: datenschutz@compenio.com

2. Overview

This website does not set cookies, does not use analytics or marketing services and does not embed third-party content. Fonts and graphics are served from our own server. We only process personal data to the extent described below. Sections 6 and 8 mainly concern clients and business partners.

3. Hosting and server log files

The website is hosted by turbopress, a service of Dipalino UG (haftungsbeschränkt), Alexander-Puschkin-Platz 1, 01127 Dresden, Germany, in a data centre in Germany. When you open a page, the server automatically processes data sent by your browser: IP address, date and time, requested page, referrer, browser type and operating system. This data is needed to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days at the latest. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

4. Contact by email

If you email us, we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual measures are concerned, otherwise Art. 6(1)(f) GDPR. We delete the data once it is no longer needed and no statutory retention obligations apply.

5. Applications

We process application documents to carry out the application procedure (Section 26 BDSG, Art. 6(1)(b) GDPR) and delete them no later than six months after the procedure has ended, unless you have agreed to longer storage.

6. Clients and business partners

When you engage us or work with us, we process the data of your contact persons, such as name, role, business contact details and correspondence, as well as contract and billing data. We use it to prepare offers and to perform and invoice contracts. The legal basis is Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR for statutory retention obligations, and otherwise our legitimate interest in an orderly business relationship (Art. 6(1)(f) GDPR).

For funding applications and reports, our clients also provide data on their employees and shareholders. This includes in particular employment contracts, payslips and payroll journals, CVs and proof of qualifications, activity and time records showing the periods of active project work, as well as shareholder lists and proof of payment. We process this data exclusively on behalf of and on the instructions of the respective client under a data processing agreement pursuant to Art. 28 GDPR. The client remains the controller.

This information is required to conclude and perform a contract with us. Without it we cannot provide our services.

We store the data for the duration of the cooperation and afterwards for as long as required by retention periods under commercial and tax law of up to ten years or by retention periods set out in grant decisions.

7. Recipients and service providers

We only pass on personal data where this is necessary for the purposes stated. Recipients are carefully selected service providers that support us with email, file storage and collaboration, accounting and invoicing, hosting, and the operation of our research and project tools. Data processing agreements are in place with these providers. Tax advisers and authorities may also receive data where we are obliged to provide it. We do not transmit data to funding bodies; our clients submit applications and reports themselves.

Some service providers are based in the USA or have parent companies there. Data is only transferred there on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework) or standard contractual clauses pursuant to Art. 46 GDPR.

8. AI-supported tools

We use AI-supported tools for research, analysis and drafting. We only use business plans under which the providers act as processors and do not use inputs to train their models. All work results are reviewed by us. We do not make decisions based solely on automated processing (Art. 22 GDPR).

9. Links to other websites

Our pages contain links to websites of other providers, such as our network partners. Data is only transferred to these providers once you follow a link. Their own privacy notices apply.

We also refer to our LinkedIn profile only with a simple link. We do not embed any content, scripts or plugins from LinkedIn. No data is therefore transferred to LinkedIn when you visit our website. Only when you click the link are you taken to LinkedIn, where the privacy policy of LinkedIn Ireland Unlimited Company applies.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future. Please contact us at datenschutz@compenio.com.

You also have the right to lodge a complaint with a data protection authority, for example the Saxon Data Protection and Transparency Commissioner, Devrientstraße 5, 01067 Dresden, Germany.

11. Version and changes

We update this policy when our data processing or the legal situation changes. Last updated: 12 November 2026