§ 1 Scope and Purpose 

1. COMPREDICT GmbH, Birkenweg 14a, 64295 Darmstadt (“COMPREDICT” or “Controller”) operates the DataPilot platform, a cloud-based software solution for automated data quality checking, data cleaning and data labeling for automotive time series sensor data, run on a web platform (“DataPilot Software” or “Services”). 
2. This DataPilot Privacy Policy explains what personal data COMPREDICT collects in connection with the provision and use of the DataPilot Software, how such personal data is used, shared and protected, and what rights the data subjects have under the General Data Protection Regulation (GDPR) and applicable German data protection law. 
3. This DataPilot Privacy Policy applies to all users of the DataPilot Software and any persons whose personal data is processed in connection with the Services. 
4. By using the DataPilot Software, the user acknowledges having read and understood this DataPilot Privacy Policy. 

§ 2 Data Controller 

1. The data controller responsible for the processing of personal data within the meaning of Art. 4 No. 7 GDPR is:
   COMPREDICT GmbH
   Birkenweg 14a
   64295 Darmstadt, Germany
   Represented by: Dr. Ing. Stéphane Foulard Commercial Register: AMTSGERICHT DARMSTADT / HRB 96101 Email: contact@compredict.de 
2. Data Protection Officer: Compliant Business Solution (ds.compredict@cb-sol.de)  

§ 3 Categories of Personal Data Collected 

1.When registering for or using the DataPilot Software, COMPREDICT may collect the following categories of personal data directly from the user: 

(a) Name, email address, telephone number and business address; 

(b) Professional information such as company name, job title, department and business contact details; 

(c) Account credentials and authentication data; 

(d) Payment and billing information (e.g. invoicing details for usage-based billing); 

(e) Information provided through support requests, feedback or other communications with COMPREDICT. 

2. When interacting with the DataPilot Software and the COMPREDICT website, COMPREDICT may automatically collect the following data: 

(a) Usage data such as features used, data volumes processed (GB), processing operations performed, upload and export activity; 

(b) Technical data such as IP address, browser type, operating system, device identifiers and user settings; 

(c) Log data including server requests, timestamps and error reports; 

(d) Cookies, web beacons and similar tracking technologies (see § 9). 

3. The DataPilot Software processes automotive time-series sensor data (e.g. CAN-Bus, MDF, CSV files) uploaded by the user (“Software Data”). Software Data typically consists of vehicle measurement signals and does not, by its nature, constitute personal data. However, if any Software Data contains personal data (e.g. GPS coordinates, driver identifiers), such data shall be treated in accordance with this DataPilot Privacy Policy and applicable data protection laws. In particular, where Software Data contains GPS coordinates, COMPREDICT may transmit such coordinates to third-party service providers (e.g. HERE Technologies) for the purpose of enriching the data with road context information such as road type, slope and geometry. The user shall be solely responsible for ensuring an appropriate legal basis to upload and process any data containing personal information. 

§ 4 Purposes of Processing 

1. COMPREDICT processes personal data for the following purposes: 

(a) to provide, operate and maintain the DataPilot Software and related Services; 

(b) to grant and manage user access to the platform, including user authentication; 

(c) to process Software Data uploaded by the user through quality checks, signal mapping, data fixing, labeling features and road context enrichment (e.g. obtaining road type, slope and geometry data based on GPS coordinates); 

(d) to calculate and process usage-based billing (based on GB of data processed); 

(e) to communicate with the user regarding their account, provide technical support and respond to inquiries; 

(f) to analyse platform usage and improve features, performance and user experience; 

(g) to send relevant product updates, documentation and — where permitted — information about the Services; 

(h) to ensure the security and stability of the platform; 

(i) to comply with legal obligations. 

§ 5 Legal Basis for Processing 

1. COMPREDICT processes personal data on the following legal bases under the GDPR: 

(a) Performance of a contract (Art. 6(1)(b) GDPR): Processing necessary to provide the Services to the user under the SaaS Agreement; 

(b) Legitimate interests (Art. 6(1)(f) GDPR): Processing necessary for COMPREDICT’s legitimate business interests, such as improving the Services, ensuring platform security and conducting analytics, provided that such interests are not overridden by the data subject’s interests or fundamental rights; 

(c) Consent (Art. 6(1)(a) GDPR): Where the user has given explicit consent, such as for marketing communications or optional cookies; 

(d) Legal obligation (Art. 6(1)(c) GDPR): Where processing is required to comply with applicable laws and regulations. 

§ 6 Disclosure of Personal Data 

1. COMPREDICT may share personal data with the following categories of recipients, solely for the purposes described in this DataPilot Privacy Policy: 

(a) Cloud infrastructure providers (e.g. AWS, Azure) that host and operate the DataPilot Software; 

(b) Service providers that assist COMPREDICT with IT administration, analytics, customer support and payment processing; 

(c) Professional advisers (legal, financial or compliance consultants) as needed; 

(d) Affiliates or partners within the COMPREDICT group, where applicable, for operational support; 

(e) Third-party data enrichment providers (e.g. HERE Technologies) that receive GPS coordinates extracted from Software Data for the purpose of providing road context information such as road type, slope and geometry. 

2. All third-party service providers are contractually obligated to process personal data only for the purposes specified and in compliance with applicable data protection laws. Where data is transferred outside the European Economic Area (EEA), COMPREDICT shall ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses. 

3. COMPREDICT may disclose personal data if required by law, in response to a valid legal process, or to protect the rights, property or safety of COMPREDICT, its users or others. 

4. In the event of a merger, acquisition or sale of all or a portion of COMPREDICT’s assets, personal data may be transferred as part of that transaction. COMPREDICT shall notify affected data subjects of any such change in ownership or control. 

§ 7 Data Retention 

1. COMPREDICT retains personal data only for as long as necessary to fulfil the purposes described in this DataPilot Privacy Policy, and in any case no longer than 28 days after cancellation or termination of the user’s account, unless a longer retention period is required by applicable law. 
2. Account data shall be retained for the duration of the user’s account and for a reasonable period thereafter to comply with legal obligations. 
3. Usage and billing data shall be retained in accordance with applicable tax and commercial law requirements. 
4. Software Data shall be retained on the platform as long as the user’s account is active. The user may delete Software Data at any time through the platform. Upon termination of the SaaS Agreement, § 5(5) and (6) of the DataPilot General Terms shall apply regarding the return and deletion of Software Data. 

§ 8 Rights of Data Subjects 

1. Under the GDPR, data subjects have the following rights regarding their personal data: 

(a) Right of access (Art. 15 GDPR) — the right to request a copy of the personal data held by COMPREDICT; 

(b) Right to rectification (Art. 16 GDPR) — the right to request correction of inaccurate or incomplete data; 

(c) Right to erasure (Art. 17 GDPR) — the right to request deletion of personal data, subject to legal retention requirements; 

(d) Right to restriction of processing (Art. 18 GDPR) — the right to request that COMPREDICT limits how it processes the data; 

(e) Right to data portability (Art. 20 GDPR) — the right to request data in a structured, commonly used and machine-readable format; 

(f) Right to object (Art. 21 GDPR) — the right to object to processing based on legitimate interests or for direct marketing purposes; 

(g) Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on consent, the right to withdraw such consent at any time without affecting the lawfulness of prior processing. 

2. To exercise any of the rights set out in paragraph (1), data subjects may contact COMPREDICT at:
COMPREDICT GmbH
Attn: Data Privacy
Birkenweg 14a
64295 Darmstadt, Germany
contact@compredict.de 

§ 9 Cookies and Tracking Technologies 

1. The COMPREDICT website and the DataPilot Software use cookies and similar technologies to ensure functionality, analyse usage and improve user experience. 
2. COMPREDICT categorises cookies as follows: 

(a) Strictly necessary cookies: Required for the platform to function (e.g. authentication, session management). These do not require consent. 

(b) Analytics cookies: Used to understand how users interact with the platform to improve functionality and performance. Used only with the user’s consent. 

(c) Marketing cookies: Used to deliver relevant content and measure campaign effectiveness. Used only with the user’s consent. 

3. Users can manage their cookie preferences at any time through the cookie consent banner or their browser settings. 

§ 10 Technical and Organisational Measures 

1. COMPREDICT implemented appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include in particular: 

(a) Encryption of data in transit (TLS) and at rest; 

(b) Access controls and authentication mechanisms; 

(c) Regular security assessments and monitoring; 

(d) Cloud infrastructure hosted within the European Union (AWS/Azure); 

(e) Employee training on data protection and information security. 

2. COMPREDICT regularly evaluates and updates its security measures to address emerging threats and ensure ongoing protection of personal data. 

§ 11 International Data Transfers 

1. COMPREDICT’s primary data processing infrastructure is located within the European Economic Area (EEA). 
2. Where it is necessary to transfer personal data outside the EEA (e.g. to service providers in third countries), COMPREDICT shall ensure appropriate safeguards are in place in accordance with the GDPR, including EU Standard Contractual Clauses or adequacy decisions by the European Commission. 

§ 12 Data Processing on Behalf of the User 

1. Where COMPREDICT processes personal data on behalf of the user (e.g. if Software Data contains personal data), COMPREDICT acts as a data processor within the meaning of Art. 28 GDPR. 
2. In such cases, COMPREDICT and the user shall enter into a Data Processing Agreement (DPA) that defines the scope, nature and purpose of processing, as well as both parties’ obligations under the GDPR. 
3. Users may request a DPA by contacting COMPREDICT at the address set out in § 2. 

§ 13 Children’s Privacy 

1. The DataPilot Software is designed for business and professional use and is not directed at individuals under the age of 16. COMPREDICT does not knowingly collect personal data from children. 
2. If COMPREDICT becomes aware that it has collected personal data from a child, it shall take steps to delete such data without undue delay. 

§ 14 Changes to this DataPilot Privacy Policy 

1. COMPREDICT may update this DataPilot Privacy Policy from time to time to reflect changes in its practices, technology or legal requirements. 
2. COMPREDICT shall notify affected data subjects of any material changes by posting the updated DataPilot Privacy Policy on its website and, where appropriate, by email. Unless required by law, changes shall take effect no earlier than 15 days after publication. 

§ 15 Applicable Law and Venue 

1. This DataPilot Privacy Policy is subject to the laws of the Federal Republic of Germany and the GDPR. The United Nations Convention on the International Sale of Goods shall not apply. 
2. Exclusive venue for any disputes arising out of or in connection with this DataPilot Privacy Policy shall be Darmstadt, Germany. 

§ 16 Contact 

For any questions regarding this DataPilot Privacy Policy or the processing of personal data, please contact:
COMPREDICT GmbH
Attn: Data Privacy
Birkenweg 14a
64295 Darmstadt, Germany
Email: yashwanth.janakiraman@compredict.de (Quality & Information Security Manager)
Website: compredict.ai