> For the complete documentation index, see [llms.txt](https://docs.prove.ly/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prove.ly/about/privacy-policy.md). # Privacy Policy *** **Last updated: September 9, 2026** {% hint style="info" %} **The short version.** This page covers data we handle for our *own* purposes: visitors to our sites, people who contact us, and the people who administer a customer account. It does **not** cover the policy campaigns and recipient records inside the platform — for those we act on our customers' instructions, and the rules are in the [Data Processing Agreement](https://docs.prove.ly/about/data-processing). If you received a Provely campaign at work, jump to [section 3](https://docs.prove.ly/about/privacy-policy#3-if-you-received-a-provely-campaign-at-work). {% endhint %} ### 1. Controller The controller responsible for the processing described on this page is: **Unicorn Markets GmbH**\ Mühlenstr. 8a\ 14167 Berlin\ Germany Email for data protection matters: Full provider identification is in the [Imprint](https://docs.prove.ly/about/about-us#imprint). Data protection officer: We are not required to appoint a data protection officer under § 38 BDSG. Questions about data protection reach us at . ### 2. Two different roles This distinction determines who is responsible for what, so it comes first. **We act as a controller** for the processing described in this policy: our websites, enquiries we receive, the administration of customer accounts, billing, and support. We decide why and how that data is processed, and this page is our transparency notice under Art. 13 and 14 GDPR. **We act as a processor** for everything inside a customer's Provely workspace — the policies uploaded, the recipients enrolled, the campaigns sent and the evidence produced. There, our customer is the controller and decides what happens. We process that data only on their documented instructions. The terms are set out in the [Data Processing Agreement](https://docs.prove.ly/about/data-processing), and this privacy policy does not apply to it. ### 3. If you received a Provely campaign at work Your employer, or the organization that enrolled you, is the controller for that campaign. They chose the policy, the recipients and the settings. Requests about your data — access, correction, erasure, objection — should go to that organization, not to us. We cannot act on such a request without their instruction, because acting on it would mean processing their data outside their instructions. If you contact us anyway we will tell you so, and we will forward your request to the responsible organization where we can identify it. What you can expect from the platform itself is described in [Where personal data lives](https://docs.prove.ly/core-concepts/where-personal-data-lives) and [Erasure and GDPR](https://docs.prove.ly/data-protection-and-security/erasure-and-gdpr). ### 4. Visiting our websites #### 4.1 Server logs When you visit prove.ly or this documentation site, technical data is recorded automatically. This typically includes the requesting IP address, the date and time of the request, the page requested, the referring page, the HTTP status code, the volume of data transferred, and the browser and operating system reported by your device. We use this to deliver the site, to keep it stable and to detect and investigate attacks. *Legal basis:* Art. 6(1)(f) GDPR. Our legitimate interest is operating a secure and functioning website.\ *Retention:* 7 days, unless a specific incident requires longer. #### 4.2 Hosting This documentation site is hosted by GitBook, Inc., 440 N Barranca Ave #7171, Covina, CA 91723, USA. Our main website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Each acts as our processor under a data processing agreement. Each acts as our processor under a data processing agreement. Both are established in the United States — see section 11 for the transfer safeguards." #### 4.3 Cookies and similar technologies We use cookies and comparable storage that are strictly necessary to deliver the site and keep you signed in. These do not require your consent. Any cookie or similar technology that is not strictly necessary — including analytics and any marketing technology — is set only after you have consented through our cookie banner. You can withdraw consent at any time with effect for the future. *Legal basis:* § 25(2) TDDDG for strictly necessary storage; § 25(1) TDDDG together with Art. 6(1)(a) GDPR where you have consented. #### 4.4 Analytics **Google Analytics** We use Google Analytics 4 to understand how our sites are used. The provider for users in the EEA and Switzerland is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (registered in Ireland, company no. 368047), acting as our processor under Art. 28 GDPR. Data collected: device and browser information, approximate location (country/city level), pages viewed, referring source, interactions with page elements, and a randomly generated identifier stored in a cookie. We do not send names, email addresses, or other directly identifying information to Google Analytics. IP addresses: Google Analytics 4 does not log or store IP addresses. The IP address is used only to derive approximate location and is then discarded; for traffic from the EEA, this happens on servers within the EU before any onward transfer. Transfers: data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and Alphabet Inc. Google LLC is certified under the EU–U.S. Data Privacy Framework, so transfers are covered by the European Commission's adequacy decision of 10 July 2023; Standard Contractual Clauses apply as an additional safeguard. *Legal basis:* Art. 6(1)(a) GDPR — consent, which you may withdraw at any time with effect for the future. ### 5. Contacting us If you write to us, book a demo, or submit a form, we process the contact details and the content of your message in order to respond. *Legal basis:* Art. 6(1)(b) GDPR where your message concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.\ *Retention:* until your enquiry is dealt with and any follow-up questions are closed. Where the correspondence qualifies as a commercial letter, statutory retention applies — see section 9. ### 6. Customer accounts and administrators Where your organization is a Provely customer and you administer the account, we process your name, business email address, role, the organization you belong to, and records of your sign-ins and administrative actions. We do this to make the account work, to authenticate you, to provide support, to bill correctly, and to keep an account-level security record. *Legal basis:* Art. 6(1)(b) GDPR, performance of the contract with your organization, and Art. 6(1)(f) GDPR, our legitimate interest in the security and correct administration of the platform. Note the boundary: your *account* exists in our controller-side records; the campaign content and evidence you create as an administrator sit on the processor side under the DPA. ### 7. Billing We process the billing contact, company details, VAT identification number, banking or payment details and invoice records in order to invoice and to meet our tax and commercial-law obligations. For self-service plans paid by card, payment is processed by Stripe as our payment processor. Card data is entered directly with Stripe and does not reach our systems; we receive only a payment reference, the payment status and the details needed for the invoice. *Legal basis:* Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR.\ *Retention:* see section 9. ### 8. Support and security When you raise a support request we process what you send us, together with the technical context needed to reproduce the problem. Our staff access customer workspace data only where necessary to resolve a request or to protect the integrity of the service, subject to confidentiality obligations and role-based controls. Such access is on our customer's behalf and falls under the DPA rather than this policy. We keep security-relevant logs of infrastructure activity to detect and investigate misuse. *Legal basis:* Art. 6(1)(b) and Art. 6(1)(f) GDPR. ### 9. How long we keep data Where a period is not stated above, we keep personal data only as long as needed for the purpose it was collected for, and then delete it unless a statutory retention obligation applies. The statutory periods that most often apply to us: | Category | Period | Basis | | ------------------------------------------------------------------------ | -------- | ------------------------- | | Accounting records, including invoices | 8 years | § 147(3) AO, § 257(4) HGB | | Commercial books, annual accounts, inventories | 10 years | § 147(3) AO, § 257(4) HGB | | Commercial and business letters, including relevant email correspondence | 6 years | § 147(3) AO, § 257(4) HGB | Retention runs from the end of the calendar year in which the document arose. Where data is retained solely to meet these obligations, its processing is restricted to that purpose. ### 10. Who receives data We disclose personal data only where necessary, and to the following categories of recipient: * **Processors** acting on our instructions under Art. 28 GDPR — hosting, email delivery, and the business tools listed below; * **Professional advisers** — tax advisers, auditors and lawyers, where bound by professional confidentiality; * **Public authorities and courts**, where we are legally obliged to disclose. The processors we engage for our own controller-side processing are: | Processor | Purpose | Location | | ------------------- | ------------------------------------------------- | ------------------------------------- | | Amazon Web Services | Infrastructure hosting | EU — `eu-central-1` (Frankfurt) | | Mailgun (Sinch) | Transactional email delivery | EU region | | Google | Enquiry and customer management | EU region | | Google Ireland Ltd | Web analytics (Google Analytics 4), consent-based | EU / USA — see sections 4.4 and 11 | | Stripe | Billing | EU region | | GitBook, Inc. | Documentation site hosting | USA — EU Standard Contractual Clauses | | Vercel Inc. | Website hosting | USA — EU-U.S. Data Privacy Framework | The subprocessors used for processing on our customers' behalf are listed separately in [Annex 3 of the DPA](https://docs.prove.ly/about/data-processing#annex-3-subprocessors). ### 11. Transfers outside the EEA All personal data processed within the Provely platform — recipient records, campaign content, evidence, account and billing data — is stored and processed exclusively in the European Union, on AWS infrastructure in the `eu-central-1` region (Frankfurt). Use of the platform involves no transfer of that data to a third country. Two processors used for our public websites are established in the United States. Visiting those sites therefore involves a transfer of the technical data described in section 4.1, principally your IP address: * **GitBook, Inc.** — this documentation site. Transfers are safeguarded by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated into GitBook's data processing addendum. * **Vercel Inc.** — our main website. Vercel is certified under the EU-U.S. Data Privacy Framework, so transfers rest on the European Commission's adequacy decision of 10 July 2023. Where that decision does not apply or ceases to apply, the EU Standard Contractual Clauses in Vercel's data processing addendum govern the transfer instead. No campaign content, evidence, account or billing data is transferred to either. You may request a copy of the relevant safeguards from . ### 12. Your rights You have the following rights in relation to personal data we hold as controller: * **Access** — Art. 15 GDPR. The first copy is free of charge. * **Rectification** — Art. 16 GDPR. * **Erasure** — Art. 17 GDPR. * **Restriction of processing** — Art. 18 GDPR. * **Data portability** — Art. 20 GDPR. * **Objection** — Art. 21 GDPR. Where we rely on legitimate interests, you may object on grounds relating to your particular situation. Where we process for direct marketing, you may object at any time without giving reasons, and we will stop. * **Withdrawal of consent** — Art. 7(3) GDPR, at any time with effect for the future, without affecting the lawfulness of processing before withdrawal. To exercise any of these, write to . We respond within one month, extendable by two further months for complex requests, in which case we will tell you. **Right to complain.** You may lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit\ Alt-Moabit 59–61, 10555 Berlin, Germany If your question concerns a Provely campaign you received at work, see [section 3](https://docs.prove.ly/about/privacy-policy#3-if-you-received-a-provely-campaign-at-work) — that request belongs with the organization that enrolled you. ### 13. Providing data Except where a contract or a statutory obligation requires it, you are not obliged to provide personal data. Where data is needed to conclude or perform a contract and you do not provide it, we may be unable to enter into or perform that contract. We will tell you when that is the case. ### 14. Automated decision-making We do not use automated decision-making producing legal effects concerning you, or similarly significantly affecting you, within the meaning of Art. 22 GDPR. The AI features in the platform draft content for a human to review and approve; they do not decide anything about a person. See [How AI is used](https://docs.prove.ly/ai-in-provely/ai). Assessment results within a campaign are calculated from recorded events, and how a customer uses them is the customer's decision as controller. ### 15. Changes to this policy We update this policy when our processing or the legal framework changes. The current version is always available on this page, with the date of the last update at the top. *** ### Related * [Data Processing](https://docs.prove.ly/about/data-processing) * [Terms](https://docs.prove.ly/about/terms) * [Imprint](https://docs.prove.ly/about/about-us#imprint) * [Data protection and security](https://docs.prove.ly/data-protection-and-security/data-protection) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.prove.ly/about/privacy-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.