Privacy policy
1. Controller
Alfred Spencer III, Founder, AS3 Compliance Consulting, Reifenstuelstrasse 2, 80469 Munich, Germany
Telephone: +49 1516 883 2801
Email: alfredspencer@as3complianceconsulting.com
2. What this website processes
Hosting and server logs. The site is hosted and delivered through Cloudflare (Cloudflare, Inc., USA, and its affiliates). When you visit, Cloudflare processes technical data such as your IP address, the date and time, the pages requested and your browser type in order to deliver and secure the site. Cloudflare also provides us with aggregated traffic statistics derived from these server logs. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor and may process data outside the EU, based on the safeguards described in its data processing terms.
Contact by email or telephone. If you email or call us, we process your message, your contact details and the content of the conversation to answer you. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual steps, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete this data once your enquiry is resolved, unless statutory retention duties apply.
Request form (demo or license). If you use the request form, you enter your name, work email, company, role, country, an optional message, the request type and your consent. When you submit it, the form data is processed by Formspree (Formspree, Inc., USA) to deliver it to us by email; it then passes through our email provider like any other email. We use the data only to handle your request, including replying to your request for a demo or for a paid license, and to send you an access code if your request for a demo is approved. The legal basis is Art. 6(1)(b) GDPR (steps at your request prior to a contract) and your consent given by ticking the box (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us. We delete request data once the request is resolved, unless statutory retention duties apply. Providing the data is voluntary, but we cannot handle a request without it. The page contains a hidden field used only to deter automated spam; it stores nothing.
Web analytics. We use Cloudflare Web Analytics to understand how many people visit the site. It does not use cookies, does not track individual visitors across sites or sessions, and reports only aggregate page views and visits. It is provided and processed by Cloudflare, which loads a small script from Cloudflare when you open a page. The legal basis is our legitimate interest in the secure and effective operation of the website (Art. 6(1)(f) GDPR).
Cookies and tracking. The site sets no cookies and uses no advertising or social-media plug-ins.
Fonts and external content. The site uses system fonts and loads no third-party fonts or embeds. The only third-party script is the Cloudflare Web Analytics script described above.
3. AS3 Compliance Program Assessment
The AS3 Compliance Program Assessment is not open to the public. It is available to licensed clients and, for a demo, by request with an access code. We send the access code after we approve your request.
The tool runs in your web browser. It saves your work in your browser, on your device. Your answers are not sent to AS3, and they are not stored on our servers. Evidence is recorded as references, for example a document name, an owner and a date. Files are not uploaded. You can delete your answers at any time under Settings.
The tool page is delivered through Cloudflare, like the rest of this site. Cloudflare processes technical data for that, as described in section 2. If you send us a progress file or results by email, we handle them like any other email, as described in section 2.
Included in the licensed version, rolling out now: a hosted version. We will update this policy to describe it.
4. Your rights
Under the GDPR you may have the right to access, rectification, erasure, restriction, data portability and objection, and the right to complain to a supervisory authority. The competent authority for Bavaria is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).
5. Changes
Last updated: 3 November 2026