This Privacy Notice explains how MatchAudit processes personal data when operating its website, account environment, commercial relationships, and SaaS platform, including its sanctions and compliance screening tools and its Vendor Assurance tools for responding to customer due-diligence and supplier-assessment requirements. It also explains the distinction between data MatchAudit processes as controller and data processed on behalf of business customers.
Effective date: October 20, 2026
MatchAudit UG (haftungsbeschränkt) ("MatchAudit", "we", "us", or "our") provides compliance evidence and Vendor Assurance software for business customers, including sanctions and compliance screening and support for organizing and responding to due-diligence and supplier-assessment requirements sent by the customer's own customers.
MatchAudit is a German company. If you interact with MatchAudit through our website, contact forms, commercial processes, account administration, or support channels, MatchAudit is generally the controller of the personal data processed for those purposes.
MatchAudit UG (haftungsbeschränkt) is located at Turmstrasse 7, 65611 Brechen, Germany and is represented by Managing Director Emmi Jose. The company is registered in the commercial register under Amtsgericht Limburg a.d. Lahn, HRB 7665.
MatchAudit provides a SaaS platform that business customers use to upload or submit data for screening, and to organize and respond to due-diligence and supplier-assessment requirements sent by their own customers. In that context, two different data-protection roles may apply.
If a customer requires a data processing agreement under Article 28 GDPR, MatchAudit can provide a DPA for the processor activities described above.
Customers may use the Service to upload or submit screening-related data, and to manage Vendor Assurance relationships, requirements, and responses. Depending on how the customer uses the platform, this may include:
For that category of data, the customer is generally responsible for determining the legal basis, purpose, and scope of processing. MatchAudit processes such data only to provide the Service and in accordance with customer instructions, applicable law, and any agreed DPA.
The public Free AMLR Readiness Check processes 3–5 documents for one sample relationship without creating an account. MatchAudit validates and scans each file, extracts readable text, uses an AI provider to classify documents and extract cited facts, and applies deterministic rules to produce the partial result.
The MatchAudit for Shopify app screens a merchant's Shopify orders and customers. It is hosted separately from the MatchAudit web service (Fly.io in Frankfurt, with a dedicated Supabase database in the EU) and has its own privacy notice, Data Processing Addendum, and subprocessor list, which govern Shopify merchant and customer data:
MatchAudit pays a commission to businesses that refer clients to it under the Referral Program Terms. For this program MatchAudit acts as controller and processes:
A partner registers a client through the registration form, which reaches MatchAudit by email, and confirms that the client contact agreed to be contacted. MatchAudit then tells the registered contact that the partner referred them and may receive a commission. A contact who does not want to be contacted can tell us, and the registration is deleted.
Attribution and commission records are kept for as long as commission can be paid or reclaimed, and accounting records for the period tax and commercial law requires. A customer may object to the disclosure to the partner at any time; the partner is then told only the commission amount.
Where MatchAudit acts as controller, we process personal data only where we have an applicable legal basis under the GDPR or other applicable law. Depending on the situation, those legal bases may include:
Customers using MatchAudit to screen personal data, or to manage Vendor Assurance relationships and responses, remain responsible for:
MatchAudit does not independently determine the lawfulness of each customer screening or Vendor Assurance workflow and does not assume the customer's compliance decision-making responsibilities.
MatchAudit may disclose or make personal data available to service providers and subprocessors where necessary to operate the Service or fulfill legal obligations. These may include:
Website contact and newsletter forms submit to MatchAudit through a same-origin endpoint. Messages are sent through MatchAudit's Microsoft 365 tenant where configured, with Resend as the continuity fallback, and are not stored in a separate form-provider database. Newsletter requests are stored in Supabase in Ireland solely to record double-opt-in status and withdrawal.
An enterprise customer may enable a ComplyAdvantage connector using its own provider entitlement. The customer chooses the processing region and instructs the import of existing screening records. The provider's role and transfer safeguards depend on the direct customer agreement and configured service chain.
MatchAudit may process or store data in the European Union and, in some cases, outside the European Economic Area through carefully selected service providers or subprocessors.
Where required by applicable law, MatchAudit implements appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms.
Before relying on standard contractual clauses, MatchAudit assesses the transfer, the destination-country legal environment, the provider's access practices, and proportionate supplementary contractual, technical, and organizational measures. Current recipients and processing locations are listed on the Subprocessors page.
MatchAudit retains personal data only for as long as necessary for the relevant purpose, contractual relationship, legal obligation, dispute handling, or security need.
MatchAudit implements technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
These measures may include access controls, role-based permissions, encryption in transit, logging, monitoring, backup procedures, and security review processes. No system can guarantee absolute security, but MatchAudit applies security measures appropriate to the nature of the Service and the risks involved.
Where MatchAudit acts as controller, individuals may have rights under applicable data protection law, including the right to request access, rectification, erasure, restriction, objection, or portability, subject to applicable legal limits and exemptions.
Individuals may also have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement.
Where MatchAudit acts only as processor for customer-uploaded screening data, requests should generally be directed to the relevant customer acting as controller. MatchAudit will support customer requests to the extent required by applicable law and the relevant DPA.
MatchAudit uses cookies or similar technologies that are necessary for core website and platform operation, security, authentication, and preference management.
MatchAudit uses optional first-party analytics and Google Analytics on public and customer-facing pages only after the visitor gives affirmative consent. Refusal has no effect on core website or platform functions. The consent cookie records the choice for up to 180 days and is necessary to remember it.
Google Analytics may set analytics cookies, including cookies whose names begin with _ga. MatchAudit sends page paths, titles, and referrers without query strings so invitation, password-reset, and similar customer-flow tokens are not transmitted in those fields. Google also receives technical request data, such as device and network information, when providing the service. MatchAudit's first-party measurement also uses page paths, referrer origins, campaign parameters, coarse geolocation from standard edge headers, and pseudonymous session estimates.
When a visitor submits a contact, setup, quote, or interest form, MatchAudit may also associate the submitting page and campaign parameters with that first-party request so sales can understand which content and acquisition channels generate qualified demand.
Before consent, Google Analytics is not loaded, MatchAudit does not store first-party analytics events, and no analytics identifier is created. Visitors can reject or withdraw consent below at any time. Withdrawal prevents further analytics collection and removes the MatchAudit and Google Analytics cookies used by this measurement. Where a browser sends a recognized privacy signal such as GPC or DNT, MatchAudit also treats that signal as an objection for this measurement flow.
Website analytics consent
Loading your analytics preference.
Your choice controls both MatchAudit's first-party measurement and Google Analytics. Core site functions remain available either way.
MatchAudit may update this Privacy Notice where required by changes in law, regulation, service design, infrastructure, or internal processes. Material updates will be published on the relevant legal page with an updated effective date.
MatchAudit UG (haftungsbeschränkt)
Turmstrasse 7
65611 Brechen
Germany
Managing Director: Emmi Jose
Commercial register: Amtsgericht Limburg a.d. Lahn, HRB 7665
Privacy-related inquiries may be sent to info@matchaudit.io.