Everything you need to trust us with your data.
CaptivaHQ is built EU-sovereign by default and is designed to meet the legal regimes of every market we operate in. Below are the customer-facing artefacts. If you need a signed copy, a country variant, or a custom DPA, contact [email protected].
Universal documents
Apply to every customer regardless of region.
- Privacy PolicyHow we collect, use, and protect your personal data.Open →
- Terms of ServiceThe contract between you and CaptivaHQ.Open →
- Data Processing Agreement (DPA)GDPR Art. 28 controller-to-processor terms.Open →
- Cookie PolicyCategories of cookies, lifetimes, and how to opt out.Open →
- Sub-processors listEvery third-party processor that touches your data.Open →
- Acceptable Use PolicyWhat you can and can't do with the platform.Open →
- Service Level Agreement (SLA)Uptime targets, credits, and incident response.Open →
- Security overviewEncryption, access control, audit logging, retention.Open →
- Standard Contractual ClausesEU SCCs (modules 1–4) for cross-border transfers.Open →
- Records of Processing Activities (RoPA)Summary of processing activities (Art. 30).Open →
Regional documents
Country- and language-specific artefacts. Each region inherits the universal set above plus any local additions.
EU