Privacy notice

For the Firmline CRA website, its early-access form and the Firmline CRA app. Last updated 3 October 2026.

Who is responsible

FIRMLINE PC, trading as Firmline, THIMATON KATOCHIS 60, 41335, LARISA, GREECE. Contact: info@firmline.eu.

What this website collects

Nothing, unless you fill in the early-access form. The site sets no cookies, runs no analytics and loads its fonts from itself. It is served from Firmline’s own server, hosted by Hetzner Online GmbH in its data centre in Finland (EU). Like any web server, it processes your IP address to deliver the pages, and keeps it in access logs for up to five weeks to keep the site secure.

The early-access form

The form sends your answers straight to Firmline’s own server, hosted by Hetzner Online GmbH in its EU data centres. No form service or other third party sees them. It collects your answers, your email address and, if you give them, your name and company. We send your invitation, and any follow-up questions, through Scaleway SAS, an email delivery provider in France.

Why, and on what basis

To send you an invitation to the beta, to ask follow-up questions if you agree to them, and to decide what to build. The basis is your consent (Article 6(1)(a) GDPR), given in the form. You can withdraw it at any time by emailing us; that doesn’t affect what we did before.

How long we keep it

Until 31 December 2026, or until you ask us to delete it, whichever comes first. We don’t sell it or share it with anyone else.

The Firmline CRA app

When your organisation uses the app, we keep your work email address, your name if you add it, your role, and when you signed in. The app sets one cookie, which keeps you signed in and is strictly necessary; there are no analytics or tracking. Your IP address is used briefly in memory to limit sign-in attempts, and kept in the web server’s access logs for up to five weeks to keep the service secure. Emails (sign-in links, invitations, deadline reminders) go out through Scaleway SAS in France. The app runs on Firmline’s server at Hetzner in Finland, and encrypted backups are stored with Scaleway in France.

For your account, we are the controller, and the basis is the contract with your organisation (Article 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (Article 6(1)(f)). We keep it while you’re a member. If you’re removed, you can no longer sign in, but your name stays on the decisions and reports you made, because they’re part of your organisation’s CRA record.

Everything your organisation puts into the app (products, SBOMs, cases, decisions, reports) is your organisation’s. For that, your organisation is the controller and we process it on its behalf, under the data processing agreement. Its owner can export or delete all of it from Settings.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, or to receive a copy. Email info@firmline.eu. You can also complain to your national data protection authority.