preeco | datenschutz

The In-House Counsel

The register is a genuinely connected model: every Article 30 mandatory field is guided in the record, activities are intelligently linked to systems, TOMs and contracts, and data processing agreements are matched to data recipients automatically by name with uncovered recipients flagged as missing. The Article 35 necessity and screening assessment is proposed from the activity itself, deletion classes derive deletion rules with deadlines and responsibilities, and external DPOs and groups can run hundreds of mandates with cross-client inheritance plus one-click status reports, procedure files and the Bavarian authority questionnaire. I hold back the top mark because missing processor connections are closed by hand, and I found no public information on TOM coverage being computed and reported off the register. 1 16 17 2 2 7

Report an error

The In-House Counsel

This is the operational half done to a standard I would defend: web-form intake, documented identity verification with time of request, all Article 15-22 request types under automatic deadline monitoring with proactive warnings, and replies sent only as a one-time link to an encrypted page. The breach workflow produces what I would actually file — nine ready templates covering the initial, follow-up and final reports to the authority under Article 33, the Article 34 notices and the German BSI reports, each with an unambiguous deadline state and a documented justification when a deadline is missed. Deletion classes tie to processing activities and derive rules with deadlines and owners, but I found no public information on execution tracking or evidence that a deletion was carried out. 18 7 2 20 19 23

Report an error

The In-House Counsel

Coverage is Germany-anchored but genuinely one-record-many-regimes: the GDPR record carries the EU AI Act conformity checks and risk classification in the same system, breach incidents emit both Article 33/34 notifications and the German NIS2 reports under a single deadline status, and Schrems II transfer impact assessments and the Bavarian supervisory questionnaire are generated from the same data. Roughly monthly, automatically distributed updates are visible maintenance of a living product. I found no public information on Swiss, UK or other national privacy regimes, so beyond the German-speaking EU this is partial coverage. 2 7 20 23 3

Report an error

The In-House Counsel

Defensibility is engineered in: every approval freezes an immutable revision, SHA-256 checksums expose any later manipulation, and the vendor advertises a fixed state of the documentation for any point in time — the answer to 'show me the state on date X'. Status reports, procedure files per processing activity and the Bavarian authority questionnaire generate at the push of a button, a complete automatic activity log records every change and administrative action with user and timestamp, and a full audit module with prebuilt catalogs and permissions separating answering from managing sits on top. I found no public information on external auditor access roles or scope-assembled evidence packs, which is what separates this from the standing-state ideal. 3 7 23 22 16 18

Report an error

The In-House Counsel

The vendor describes the application as a closed system with no public REST API, developing customer-specific endpoints only for Private Cloud and On-Premises; I found no public information on directory import, ticketing or HR connectors, webhooks or SCIM. What the pages do show: structured DOCX and XLSX import of existing registers, embeddable web forms via HTML snippet, a Model Context Protocol server that lets an AI assistant query activities and export revisions under application access rights, optional SAML2 single sign-on on the higher hosting tiers, and AI drafting that must pass review and approval before entering documentation. Automation is reminders, recurrence and scheduled reports rather than a live feed from the IT estate. 2 15 24 3 2 12

Report an error

The In-House Counsel

The compliance record lives under German law end to end: a German entity in Ulm, hosting exclusively in the named Hetzner data centers in Nuremberg and Falkenstein, the vendor stating no transfer of personal data to third countries, and a published data processing agreement with downloadable TOMs and two weeks' written notice of subprocessor changes. The hosting subprocessors named on the vendor's privacy policy are Hetzner in Germany and UpCloud in Finland, on-premises is available where data may never leave the customer's datacenter, and the AI functions are off by default and can run against the customer's own endpoint. I deduct for the undocumented ownership structure and because the same privacy policy concedes that transfers to the US parent companies of LinkedIn, Google and X are not excluded for the vendor's own website. 5 15 9 10 6 9

Report an error

The In-House Counsel

I found no public price figures at all; the license is described only as scaling with employees, modules and hosting variant — usefully never with the number of organizations managed, which matters to a group or a consultancy. The vendor does state there are no setup fees and no cancellation periods and that every GDPR obligation ships without add-on modules, but premium support, the DeepL integration, the optional audit catalogs and data migration are all optional and chargeable with no numbers anywhere, and even the FAQ treats premium support costs as an open question. The real invoice is therefore a sales conversation. 2 3 7 15 8

Report an error