What is true today, and what is not yet.

Our role under the Act

We supply software to Data Fiduciaries. In that relationship we act as a Data Processor, processing personal data on your instructions and for your purposes. We are not a Consent Manager registered with the Data Protection Board under Sec 6(7)–(9) and Rule 4, and we do not present ourselves as one.

On this website, for our own visitors and enquirers, we are the Data Fiduciary.

This website

• Consent is default-deny. Nothing beyond strictly necessary storage is set until you choose it, and no purpose is pre-ticked.
• Accept, reject and granular control are given equal prominence, and withdrawal is available at all times from the Preference Centre.
• Your consent decisions on this site are stored in your own browser as versioned artefacts, recording the notice version and language shown.
• The free tools run entirely in your browser. Your answers to the applicability checker and readiness assessment are never transmitted to us.
• We do not use exit-intent modals, do not gate results behind an email field, and do not sell contact data.

What is not yet true

We hold no third-party security certification, and no independent audit report exists for TruPriv today. When that changes we will name the standard, the auditor and the date, and not before. Any page on this site that describes planned work is describing an intention, not shipped software.

Reporting a security or privacy concern

Write to us via the contact page. Security reports are read first. We will acknowledge receipt, tell you what we found, and we will not threaten a good-faith researcher.

Shared responsibility

Where TruPriv provides a control, using it correctly remains the Data Fiduciary's obligation. Software cannot decide your purposes, write your notice, or determine your retention periods. It can only make those decisions enforceable and evidenced once you have made them.