GDPR Compliance

For legal teams, procurement officers, and compliance departments evaluating Global Search for enterprise use.

Last updated: July 2026  ·  Questions? [email protected]

1. Our Commitment

Global Search is a data intelligence platform registered and operating in Austria, a member state of the European Union. As such, we are directly subject to Regulation (EU) 2016/679 (the General Data Protection Regulation) and the Austrian Datenschutzgesetz (DSG).

Our platform serves B2B clients — law firms, corporate compliance teams, financial institutions, and licensed investigators. The platform aggregates information from public records and licensed data sources. When enterprise clients use Global Search, two separate data processing relationships apply:

• Client account data (names, email addresses, billing details, user credentials) — we act as a data controller under the GDPR, and this data is processed to operate the service.
• Search subjects (individuals looked up through the platform) — enterprise clients determine the purposes and means of these queries; Global Search acts as a data processor on behalf of the client for query execution. Clients are responsible for ensuring their use is lawful under GDPR Article 6 or applicable national law.

We do not sell client data to third parties. We do not use client query content for advertising or profiling.

2. Data Processing Agreement (DPA)

Global Search offers a fully executed Data Processing Agreement to enterprise clients. The DPA covers:

• Subject matter, duration, and nature of processing
• Sub-processor obligations and onward transfer controls
• Technical and organisational security measures (TOMs)
• Data subject rights assistance procedures
• Incident notification timelines (72-hour breach notification to supervisory authority; prompt notification to client)
• Audit rights and instructions for deletion/return of data upon contract termination

To request a DPA, contact us at [email protected]. We typically return a countersigned DPA within 5 business days.

3. What We Process — Client Data

The following categories of personal data are processed in connection with operating client accounts:

Data category	Purpose	Retention
Account data Name, email, organisation	Account creation, authentication, billing, and support communications	Duration of contract + 3 years for legal compliance
Query logs IP address, timestamp, query type (not result content)	Abuse prevention, rate limiting, service integrity monitoring	90 days, then automatically deleted
Billing records Transaction IDs, amounts, payment method type	Invoicing, tax compliance, dispute resolution	7 years (Austrian tax law requirement)
Support communications Email correspondence	Customer support	2 years from last interaction

What we do not log: The content of search results returned to clients is not stored on our servers after delivery. Query logs record the type and timestamp of a query but not the results themselves.

4. Data Subject Rights

Under the GDPR, individuals have the following rights with respect to their personal data processed by Global Search. Submit requests to [email protected]. We respond within 30 calendar days; complex requests may be extended by a further 60 days with notification.

Right of Access Art. 15

You may request a copy of the personal data we hold about you and information about how it is processed.

Right to Rectification Art. 16

You may request correction of inaccurate or incomplete personal data.

Right to Erasure Art. 17

You may request deletion of your personal data where there is no overriding legal basis for continued processing. Note that certain data (e.g. billing records) must be retained to meet legal obligations.

Right to Data Portability Art. 20

You may request your account data in a structured, machine-readable format (JSON or CSV).

Right to Restriction Art. 18

You may request that processing of your data be restricted while a complaint or accuracy dispute is being resolved.

Right to Object Art. 21

You may object to processing carried out under legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.

Right to Lodge a Complaint

If you believe your rights have not been respected, you have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): www.dsb.gv.at.

5. Sub-Processors

Global Search uses the following sub-processors. We maintain Data Processing Agreements with all of them and conduct due diligence on their GDPR compliance status.

Sub-processor	Role	Location
Stripe	Payment processing. Processes billing name, card details (tokenised), transaction records. Full cardholder data never reaches our servers.	EU data residency (Ireland)
EU-based infrastructure provider	Cloud hosting and compute. Server infrastructure on which the platform runs.	EU/EEA

No tracking or marketing SDKs: We do not load Google Analytics, Meta Pixel, HubSpot, Segment, Intercom, or any similar third-party marketing or analytics tools on our platform. There are no third-party cookies. No client behaviour data is shared with advertising networks.

6. International Data Transfers

All personal data processed by Global Search is stored and processed within the EU/EEA. We do not transfer personal data to third countries (outside the EU/EEA) as a matter of ordinary operation.

In the event that a future business requirement necessitates a third-country transfer (for example, engaging a sub-processor headquartered outside the EEA), we will implement appropriate safeguards in advance — specifically Standard Contractual Clauses (SCCs) as approved by the European Commission, supplemented by a Transfer Impact Assessment where required.

Stripe's EU data residency option is selected, ensuring payment data remains within the EEA.

7. Security Measures

Global Search implements the following technical and organisational measures (TOMs) to protect personal data:

Encryption

• All data in transit is protected by TLS 1.3. Connections using older protocol versions are rejected.
• Data at rest is encrypted at the storage layer.
• Passwords are hashed using bcrypt with per-account salts. Plaintext passwords are never stored or logged.

Access Controls

• Production systems are accessible only through authenticated VPN with certificate-based authentication. Password-based SSH login is disabled.
• Staff access to production data follows the principle of least privilege. Access rights are reviewed quarterly.
• API authentication uses session tokens with defined expiry. Tokens are invalidated on logout.

Monitoring and Audit Logs

• All administrative access to production systems is logged with timestamps and identifiers.
• Intrusion detection (fail2ban) is active on all public-facing infrastructure.
• Anomalous access patterns trigger automated alerts to the security team.

Incident Response

• We maintain an incident response procedure with defined escalation paths.
• In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Affected clients will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34).

8. Legal Basis for Processing

We rely on the following legal bases under GDPR Article 6:

• Article 6(1)(b) — Performance of a contract: Processing of account data (name, email, billing) is necessary to provide the service under our Terms of Service. Without this data, we cannot authenticate users or process payments.
• Article 6(1)(c) — Legal obligation: Billing record retention for 7 years is required under Austrian tax law (Bundesabgabenordnung).
• Article 6(1)(f) — Legitimate interests: Processing of query logs (IP address, timestamp, query type) for 90 days is based on our legitimate interest in preventing abuse, ensuring service integrity, and investigating misuse. This interest is balanced against users' privacy interests; result content is not stored, logs are deleted after 90 days, and access is restricted.

9. Contact and DPO

For privacy-related enquiries, data subject rights requests, or to discuss a Data Processing Agreement:

• General privacy: [email protected]
• DPA requests: [email protected]
• Registered jurisdiction: Austria, European Union
• Supervisory authority: Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Wien

Request a DPA