Privacy notice
Consent wording version 2026-07-01.
Who is responsible
EU Conformance Hub, Niels Andersens Vej 57, 2900 Hellerup, Denmark, is the data controller for personal data collected through www.conformancehub.eu. Privacy questions: privacy@conformancehub.eu.
What we collect, and why
| Data | Why we need it | Legal basis (GDPR) |
|---|---|---|
| Email address | To send you the report you asked for, and to sign you in to your account | Art. 6(1)(b) — performance of a contract you requested |
| Website URL you submit | To run the scan | Art. 6(1)(b) |
| Name, company, role (optional) | To address the report correctly and lead with the section relevant to your role | Art. 6(1)(a) — consent; you may leave these blank |
| Marketing consent, with timestamp, IP address and browser string | To send you related information about EAA conformance, and to evidence that consent was given | Art. 6(1)(a) — consent; Art. 7(1) requires us to be able to demonstrate it |
| Scan results, including short fragments of your page markup | To produce the report and let you re-open it later | Art. 6(1)(b) |
| IP address of the request | Rate limiting and abuse prevention | Art. 6(1)(f) — legitimate interest in keeping the service available |
| Payment details | Processed entirely by Stripe. We never see or store your card number. | Art. 6(1)(b) |
The consent you give when you request a scan
I agree that EU Conformance Hub may email me the results of this scan and occasional related information about European Accessibility Act conformance. I can withdraw consent at any time via the unsubscribe link in any email.
That box is not pre-ticked, and it is separate from the act of requesting the scan. We store what you agreed to, the version of the wording, and when. Withdrawing consent is one click in any email, or on our unsubscribe page, and it is as easy to withdraw as it was to give. Withdrawal does not affect the lawfulness of anything sent before it.
One clarification: the report itself is what you asked us for, so we will deliver it even if you later withdraw marketing consent. What stops is everything else.
What we deliberately do not do
- No advertising or analytics cookies. The only cookie we set is the one that keeps you signed in.
- No third-party trackers, pixels or session recorders on this site.
- We do not sell, rent or share your data with anyone for their own marketing.
- We do not enrich your record from data brokers.
- No automated decision-making with legal effect. The exposure score is descriptive, not a decision about you.
Cookies
| Cookie | Purpose | Duration |
|---|---|---|
ech_session | Keeps you signed in to your report dashboard. Strictly necessary. | Session length configured by us; expires automatically |
ech_admin | Administrator sign-in. Only ever set for our own staff. | As above |
Both are strictly necessary for a service you requested, so no consent banner is required — and we have not built one.
Who processes data on our behalf
| Processor | Purpose | Location |
|---|---|---|
| Stripe Payments Europe, Ltd. | Payment processing | Ireland / EU |
| Email delivery provider | Transactional email | EU |
| Hosting provider | Application hosting | EU |
Each is bound by a data processing agreement under Art. 28 GDPR.
How long we keep it
- Free scan results and contact details: 180 days.
- Paid reports: 3 years — you may need to produce them to a regulator.
- Consent records: kept while consent stands and for a period after withdrawal, because Art. 7(1) requires us to be able to demonstrate it.
- Invoices: as required by tax law in our jurisdiction.
Your rights
You have the right of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. Email privacy@conformancehub.eu and we will respond within one month. You may also complain to your national supervisory authority; ours is Datatilsynet (Danish Data Protection Agency).
Whose website you can scan
By submitting a URL you confirm you own the site or are authorised to have it tested. Scanning is read-only and no more intrusive than an ordinary visit, but the responsibility for authorisation is yours. We log the requesting IP address for every scan.
Security
Data is encrypted in transit. Sign-in is passwordless and link-based, so there are no passwords to breach. Scans run in isolated processes with no access to customer records beyond the scan they were started for. Report URLs contain a long random identifier and are not indexed or guessable.