What is collected when you complete the gap analysis, who gets to see it, and where it is stored.
Last updated 20 September 2026
Who is responsible
The law firm is the controller for the data you enter. Avaris AS supplies and operates the tool as processor on the firm’s behalf. The processing is governed by a data processing agreement between the parties.
What is collected
Contact details
Name, organisation, email address and phone number, as you enter them.
Your answers
The scope assessment and your answers to the questions about the organisation’s practices.
Technical
The address of the page the analysis was started from, and the time.
Consent
The record that you ticked the box allowing the data to be shared with the law firm.
The tool sets no tracking cookies and loads no fonts, scripts or images from third parties. Everything is served by the service itself.
What it is used for
To show you the result of the analysis, and to give you access to it again later.
To give the law firm a basis for following up with you, where you have consented.
To operate and troubleshoot the service.
The data is not used for anything else, and is neither sold nor shared further.
Where it is stored
For this demo, all data is stored in Microsoft Azure in Norway East, inside the EEA. In a production deployment the region is chosen with the firm, and any EU region is available. The database sits behind a firewall and requires an encrypted connection.
Sub-processors
Microsoft Azure
Hosting and storage. Norway East (EEA).
Anthropic
Generates policy drafts on request. Receives the organisation name and the description of the gap in question. Does not receive names, email addresses or phone numbers.
Policy drafts are generated only when someone asks for one. Contact details never leave Azure.
How long
The analysis and the contact details are kept for as long as the law firm needs them for the follow-up, and are deleted afterwards. The link that gives you access to your own analysis is valid for 14 days and can be reissued.
Your rights
You can ask for access to, correction of or deletion of the data, and you can withdraw your consent. Requests go to the law firm as controller. You can also lodge a complaint with your national data protection authority.
Security
All traffic is encrypted over TLS.
Access to your own analysis requires a one-time link sent to your email address.
The database is closed to outside access and requires an encrypted connection.
Avaris notifies the law firm without undue delay in the event of a personal data breach.