ClassEngine.eu
←Back to Home
Legal

Privacy Policy

Last updated: 21 May 2026

1. Introduction

This Privacy Policy explains how [ClassEngine Operating Entity], trading as ClassEngine.eu (“we”, “us”, “our”, or the “Platform”), collects, uses, stores, and protects your personal data when you use our website at classengine.eu and related services.

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act 2018, and all applicable data protection laws in the jurisdictions in which we operate.

ClassEngine.eu is a lead generation platform that connects consumers affected by corporate breaches with qualified law firms. We are not a law firm and do not provide legal advice.

2. Data Controller

The data controller responsible for your personal data is:

[ClassEngine Operating Entity]
Trading as ClassEngine.eu
Email: privacy@classengine.eu

Our Data Protection Officer (DPO) can be contacted at: privacy@classengine.eu

3. Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with the Platform:

3.1 Data you provide directly

  • Registration data: Name, email address, country/jurisdiction of residence
  • Claim details (optional): Description of the breach or claim you may be affected by
  • Communication data: Any information you provide when contacting us via email or support forms

3.2 Data collected automatically

  • Technical data: IP address, browser type and version, operating system, device type
  • Usage data: Pages visited, time spent on pages, referral source, navigation paths
  • Cookie data: Essential session cookies and locale preference (NEXT_LOCALE). See our Cookie Policy for full details

4. Lawful Basis for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

  • Consent (Art. 6(1)(a)): For marketing communications, email alerts about new cases, and non-essential cookies. You may withdraw your consent at any time.
  • Contract (Art. 6(1)(b)):When you register to be connected with a partner law firm, processing is necessary for the performance of our service—matching you with appropriate legal representation.
  • Legitimate interest (Art. 6(1)(f)): For Platform operation, security, fraud prevention, service improvement, and internal analytics. We have conducted a legitimate interest assessment to ensure our interests do not override your fundamental rights and freedoms.
  • Legal obligation (Art. 6(1)(c)): Where we are required to retain or disclose data to comply with a legal obligation.

5. How We Use Your Data

We use your personal data for the following purposes:

  • To register you on the Platform and create your account
  • To match you with relevant class action cases and partner law firms
  • To share your data with partner law firms (only with your explicit consent)
  • To send you case alerts and marketing communications (with your consent)
  • To operate, maintain, and improve the Platform
  • To respond to your enquiries and provide support
  • To comply with legal obligations and protect against fraud
  • To generate anonymised, aggregated statistics about Platform usage

6. Data Sharing and Third Parties

We share your personal data with the following categories of recipients:

6.1 Partner law firms

When you opt in to be connected with a law firm for a specific class action, we share the relevant registration and claim data with our vetted partner law firms. This sharing occurs only with your explicit consent and for the specific purpose of facilitating your participation in collective redress proceedings.

6.2 Litigation funders

Where cases are supported by litigation funders, anonymised or aggregated claimant data may be shared for case assessment purposes. Identifiable personal data is shared with litigation funders only with your explicit consent.

6.3 Data processors

We use the following data processors who act on our instructions:

  • Supabase: Database hosting (EU-hosted infrastructure). Supabase acts as a data processor under a Data Processing Agreement (DPA).
  • Vercel: Website hosting and content delivery. Vercel processes technical data as part of serving the Platform.

6.4 Legal and regulatory disclosures

We may disclose your data where required by law, regulation, legal process, or governmental request, or to protect our rights, property, or safety or that of our users.

7. International Data Transfers

We primarily store and process personal data within the European Economic Area (EEA). Our database infrastructure (Supabase) is hosted in the EU.

Where data is transferred outside the EEA (for example, through the use of hosting or analytics services), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions where the European Commission has determined the receiving country provides adequate data protection
  • Other approved transfer mechanisms under Article 46 of the GDPR

8. Data Retention

We retain your personal data in accordance with the following periods:

  • Registration and claim data: For the duration of the relevant case plus 6 years (reflecting the applicable statute of limitations across our operating jurisdictions)
  • Marketing consent records: Until consent is withdrawn, plus a reasonable period to process the withdrawal
  • Communication records: 3 years from the date of the last communication
  • Technical and usage data: 26 months from collection
  • Account data for inactive accounts: 3 years after last activity, after which we will contact you to confirm whether you wish to retain your account

When the retention period expires, we will securely delete or anonymise your personal data unless further retention is required by law.

9. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR. You can exercise any of these rights by contacting us at privacy@classengine.eu.

  • Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data.
  • Right to rectification (Art. 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
  • Right to erasure (Art. 17): You have the right to request the deletion of your personal data in certain circumstances, including where the data is no longer necessary for its original purpose.
  • Right to restriction (Art. 18): You have the right to request restriction of processing in certain circumstances, such as where you contest the accuracy of the data.
  • Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
  • Right to object (Art. 21): You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. If you are in Ireland, the relevant authority is the Data Protection Commission (DPC) at www.dataprotection.ie.

We will respond to all data subject requests within 30 days of receipt. Where requests are complex or numerous, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Access controls and authentication for internal systems
  • Regular security assessments and vulnerability testing
  • Data Processing Agreements (DPAs) with all third-party processors
  • Staff training on data protection obligations

11. Children’s Data

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete that data promptly.

12. Automated Decision-Making

We do not engage in automated decision-making, including profiling, that produces legal effects or similarly significantly affects you, as defined under Article 22 of the GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting the updated policy on this page and updating the “Last updated” date. Where changes are significant, we will notify you by email.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how we handle your personal data, please contact us:

Data Protection Officer
[ClassEngine Operating Entity]
Email: privacy@classengine.eu

General enquiries
Email: hello@classengine.eu