in-house privacy

You signed the DPAs.
You get asked about them.

A hundred vendors, one of you, and an objection window that starts running whether or not anyone noticed. We keep the annex current and put the decision in front of you while there is still time to make one.

Start my discovery → What Article 28 asks for

Open windows

4 closing this week

your DPA · clause 6.24 days

your DPA · clause 4.19 days

standard 30-day clause17 days

Windows come from the contracts you uploaded. Where we do not have yours, we say so rather than assuming.

what actually goes wrong

Nobody misses these on purpose.

Every failure we see is procedural rather than negligent, which is why a process fixes it.

the silent change

The page moved, the email did not

A vendor updates their list and the notice never arrives, or arrives at an inbox that left with someone in 2024.

the late notice

It arrived, nine days in

The window opened when the change happened. By the time it reaches you a third of it is gone.

the audit

“Show me last March”

Not what the list says now — what it said then, and what you decided about it at the time.

what you get

Four things, aimed at your specific job.

Your Article 28 annex, kept current
Discovered from six sources, reviewed by a person, published at your address or ours, with a dated history rather than a “last updated” line.
Windows read from your own contracts
Upload the DPAs once. We extract each notification clause, a reviewer confirms it, and every countdown after that is contractual rather than assumed.
Notices to your customers, in your name
They subscribe to your page. When you approve a change the notice goes out from you — so you are meeting the obligation, not just observing it.
The record for when you are asked
Every change, every decision, who made it and when, exportable and verifiable without our cooperation.

“I need to know the day it changes, not the quarter.” the requirement, from every privacy lead we have spoken to

the boundary

We are not your legal adviser, and not your notice channel.

Both of those roles already exist. Filling them badly would be worse than not filling them.

We do not tell you whether you are compliant
We publish observations and dated records. What they mean for your obligations is yours and your counsel’s to decide.
We do not replace the notice your vendor owes you
Article 28 puts that duty on them. We exist so you can check they met it, and catch the ones who did not.
We do not assert breach
A page changed, on a date, with the evidence attached. What follows is your call.

Start my discovery → How the detection works

You signed the DPAs.You get asked about them.