Privacy Office

Data protection is rarely hard because a single document is complicated. It is a slog because so many pieces interlock: the privacy policy references your processors, the processors need a data processing agreement, the DPA assumes technical and organisational measures, and your records of processing have to reflect all of it cleanly. The Privacy Office lays these eleven tools side by side so you stop jumping between eleven tabs and three templates.

It starts with the statements. The privacy policy generator builds your policy block by block: contact form, hosting, analytics, newsletter, social media. The cookie policy generator produces the matching cookie table with purpose, provider and lifetime, and the GDPR cookie banner delivers a consent banner with real opt-in that only loads once the visitor has actually agreed. Three tools, one coherent set of texts for your website.

As soon as external processors are involved, you need contracts. The DPA generator creates a data processing agreement under Art. 28 GDPR that you present to your processors or have them countersign. Alongside it, the TOMs generator documents your technical and organisational measures - access control, encryption, permissions and backups - in a structure a supervisory authority recognises immediately.

The heart of any GDPR documentation is the records of processing activities under Art. 30. The Art. 30 helper walks you through it processing by processing: purpose, legal basis, categories of data subjects, recipients, deletion deadlines. The purpose library hands you ready-worded purposes and matching legal bases to reuse, and the processor register keeps every processor with its DPA status in one place, so you can see at a glance where a contract is still missing.

Where risk is involved, the data protection impact assessment comes into play. The DPIA quick check asks you a few short questions about whether your processing is likely to carry a high risk and therefore requires a full assessment under Art. 35. Not a legal opinion, but an honest traffic light that tells you whether you need to look more closely.

At the end comes deletion, and that is exactly what gets forgotten most often. The deletion concept generator builds a concept along DIN 66398, with deletion classes and standard periods per data type. The retention planner keeps the concrete storage and deletion deadlines in view, from the ten years for invoices to the immediate deletion of a rejected job application. Together they make sure data does not linger forever just because nobody thought about it.

Everything runs locally in your browser. Your company data, your processor list, your processing purposes - none of it is sent to a server while you work. The individual tools stay reachable on their own; the office is just the shared workbench on top. So you can always open a single tool without needing the whole suite.

And the honest note up front: the Privacy Office does not replace legal advice. It takes the dull grind off your plate and gives you seriously good groundwork, but for tricky cases, international data transfers or special categories of personal data, get a look from a lawyer or your data protection officer. We are on your side, not your liability shield.