Cognigy procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ 14.7 The information generated by the web beacons and cookies about your use of the Cognigy websites is usually transferred to a Hubspot server in the USA and stored there. The same applies to the other information and data that we process with Hubspot. Hubspot has entered into the EU Standard Contractual Clauses and thus undertakes to comply with EU data protection regulations.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in 14 days. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ These data are stored in log files on our web server by default. The IP address is stored for one week, after which it is automatically deleted. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 7.4 After three (3) years following the expiration of your free trial period, we will delete your personal data you have submitted for the subscription, unless we are legally obliged to keep it for a longer period of time or we still need your personal data for the execution or settlement of an existing contractual relationship (e.g. if you decide to continue the use of our software) or for verification purposes. In such a case, we will delete the relevant data after the legal retention period has expired or as soon as we no longer require the data for the execution or processing of an existing contractual relationship or for verification purposes.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 17.4 The user data collected with Hotjar is stored by Hotjar for a period of 365 days and then deleted.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 8.4 We will delete the personal data as soon as we no longer require such data for the aforesaid purposes, but latest after 30 days. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 14.6 The user data collected with Hubspot is stored in cookies for the period specified for each cookie in section 11.2 above.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 13.3 The user data collected with Google Analytics is stored by Google for a period of 14 months and then deleted.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ 7a.5 We will delete the personal data as soon as we no longer require such data for the aforesaid purposes. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “6.4 Nine (9) months after sending the reply, we will delete the data you have transmitted via the contact form, unless we are legally obliged to keep it for a longer period of time or we still need your personal data for the implementation or processing of an existing contractual relationship or for verification purposes. In such a case, we will delete the relevant data after the legal retention period has expired or as soon as we no longer require the data for the implementation or processing of an existing contractual relationship or for verification purposes. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in seven days. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires at the end of the session. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in one year. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in two years. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in 30 minutes. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in 13 months. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 15.4 The user data collected with Facebook Pixels is stored by Facebook for a period of 180 days and then deleted unless you visit again the Cognigy websites during this period.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ • It expires in one day. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We use Clearbit, a B2B marketing intelligence data software. API Hub, Inc. dba Clearbit is a Delaware corporation and HubSpot Affiliate. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “5.5 In some cases, we offer not only to receive Cognigy marketing communication but in addition to receive marketing communication of a specified Cognigy partner. When you register to receive the Cognigy and the Cognigy partner marketing communication, we will forward your e-mail address and the additional personal data, that you voluntarily have sent us in the context of your registration, to the specified Cognigy partner for the sole purpose that the specified Cognigy partner can send you its marketing communication by e-mail. The regulations stated above apply respectively, provided that the Cognigy partner is the controller for data processing. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 16.4 For more information on the purpose and scope of LinkedIn’s data collection and processing, please refer to LinkedIn’s privacy and cookie policy on LinkedIn’s website. We are familiar with the following website in this respect:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 14.8 For more information on the purpose and scope of Hubspot’s data collection and processing, please refer to Hubspot’s privacy and cookie policy on Hubspot’s website. We are familiar with the following websites in this respect:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 18.1 We use iframes (inline frames) on the Cognigy websites to display embedded YouTube content from Google Ireland Limited, registered under the Laws of Ireland with company number register no. 368047, having its registered address situated at Gordon House, Barrow Street, Dublin 4, Ireland.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 8.2 To provide you with more relevant and efficient answers, we may share your input with Azure OpenAI (for more information see Data, privacy, and security for Azure OpenAI Service - Azure AI services | Microsoft Learn . Note that your personal data will not be used to train the foundation models or to improve any other Microsoft products). We may also provide the personal data for the purpose of communicating with you via Zendesk if you are a Cognigy customer with access to our support program. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 15.5 For more information on the purpose and scope of Facebook’s data collection and processing, please refer to Facebook’s privacy and cookie policy on Facebook’s website. We are familiar with the following website in this respect:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 17.1 We use Hotjar in order to better understand our users’ needs and to optimize the Cognigy websites and your experience. The Hotjar service is being provided by Hotjar Limited, a private limited liability company registered under the Laws of Malta with company number C 65490, having its registered address situated at Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta (“Hotjar”).” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ For more informations about how Clearbit works visit the Clearbit Privacy Policy. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 17.5 For more information on the purpose and scope of Hotjar’s data collection and processing, please refer to Hotjar’s privacy and cookie policy on Hotjar’s website. We are familiar with the following website in this respect:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We use DreamData tool developed and marketed by DreamData.io ApS in Købmagergade 22, 2nd floor, 1150 Copenhagen – DK (“DreamData”). Dreamdata is a no-code revenue attribution platform that gathers, joins, and cleans all revenue-related data to present transparent, actionable analysis of what drives B2B revenue. Please, find more information in Dreamdata’s privacy policy and Dreamdata’s cookie policy . ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “18.4 The user data collected with YouTube iframes is stored by Google for a period defined by Google and then deleted.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 14.2 Hubspot is an integrated system for marketing and sales activities with which we operate our content management (e.g. landing pages, forms and blogs), manage contact forms and carry out e-mail marketing including dispatch and reporting. We also use Hubspot for publications in social networks and for the associated reporting. Hubspot offers a variety of setting options to meet data protection requirements. We made use of this option.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 18.5 For more information on the purpose and scope of YouTube’s data collection and processing, please refer to Google’s privacy and cookie policy on Google’s website. We are familiar with the following website in this respect:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 4.4 Your personal data will not be passed on, sold or otherwise transferred to third parties. Anything to the contrary shall only apply if this is necessary for the execution of the notified or agreed purposes and is permitted under applicable data protection law without consent, if you have expressly given your consent, or if we are legally obliged to do so. Section 4.3 remains unaffected and applies independently of section 4.4.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 7a.4 Apart from cases in which we are legally obliged to do so, we will also not pass on your personal data to third parties.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 14.1 As described in more detail in sections 13.2 ff. below, we use the inbound marketing service Hubspot of the US company Hubspot, Inc. provider is Hubspot, Inc. 25 First Street, 2nd Floor Cambridge, MA 02141, USA (“Hubspot”) on the Cognigy websites.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 4.3 We contracted various service providers to support us in the provision, operation and maintenance of our IT systems, including the Cognigy websites. These include, for example, hardware, web services and software suppliers,, hosting providers or data centers. When such service providers work for us, they may be given access to your personal data as recipients. However, these service providers are then contractually obliged to comply with data protection by means of a so-called order processing agreement; the statutory provisions on data protection also apply to our service providers anyway.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 17.2 Hotjar is a technology service that helps us to better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on your behavior as a user of Cognigy websites and your devices. This includes your device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.