For procurement, legal and information security
Everything your vendor assessment asks for
Who you contract with, who is liable, who processes the data, what is insured, and what we can put in writing. Gathered here instead of spread across the imprint, the Trust Center and the pricing page. Where we do not hold something yet, it says so rather than sitting in a footnote.
The PDF has the same content as this page, formatted for your supplier file. The page is the current version; if the two ever differ, the page is correct.
1 · Company master data
The entity you contract with
One legal entity carries every engagement, invoices it and is liable for it. The member companies of the Alliance deliver under its responsibility as named subcontractors.
| Legal name | Promo Consulting Solutions GmbH |
|---|---|
| Brand | FIBRE® — the platform the campaigns run on |
| Network | Competence Alliance — the name the member companies operate under, and the name in the imprint |
| Legal form | Gesellschaft mit beschränkter Haftung (GmbH), German law |
| Registered office | Hanau, Germany |
| Business address | Wuhlestraße 7a, 12683 Berlin, Germany |
| Commercial register | Amtsgericht Hanau, HRB 99379 |
| VAT identification number | DE306119576 |
| Trading since | 2016 as Promo Consulting Solutions GmbH and as the Competence Alliance. Consumer promotions since 2010, before that through a predecessor entity that has since been consolidated and is no longer used. |
| Managing director | Bernhard Mueller, PhD |
| Telephone | +49 661 29191 488 |
| info@competence-alliance.global | |
| Website | competence-alliance.global |
| Full legal details | Imprint → |
A current extract from the commercial register and a Creditreform credit report are provided on request, so a supplier assessment does not stall on paperwork. Registration in your own supplier portal, including a D-U-N-S number where your process requires one, is arranged on request.
2 · Contract, liability, insurance
Who stands behind the campaign
| Contracting party | Promo Consulting Solutions GmbH, Berlin. One contract, one invoice, one liable counterparty. |
|---|---|
| Structure | A network of legally separate companies across digital and marketing, events and software engineering, plus licensed attorneys in all 41 markets. Some members hold shares in one another, wholly or in part; between others there are none. This is not a group under common control: your sole contracting party, and your counterparty for liability, is Promo Consulting Solutions GmbH. |
| Subcontractors | Which member company delivers which part is named in the offer and in the subcontractor list, before you commit, together with how the shareholdings run. Members that hold shares in one another go through the same approval as any other subcontractor. You never have to coordinate them. |
| Term and notice | Agreed per campaign, in the services agreement. |
| Governing law | German law. The place of jurisdiction is agreed in the services agreement. |
| Liability | Set out in the services agreement, with a cap. The execution guarantee sits on top: if a market has to be stopped or re-run because of an error we are responsible for, we refund the campaign operating fee for that market. |
| Insurance | Promo Consulting Solutions GmbH carries public liability insurance (Betriebshaftpflicht) and professional indemnity insurance (Vermögensschadenhaftpflicht). Both policies are held by the contracting entity and their territorial scope covers the European markets we operate in. A current certificate stating the sums insured is provided on request, before contract. |
| Data and content rights | You are the controller of the campaign and participant data; we process it on your instructions and you can export it at any time in a structured format, within the consent, the purpose and the legal basis it was collected under. The content created for you is yours. We retain the rights in the FIBRE platform and its components. |
The execution guarantee and its exclusions are set out in the services agreement. What the guarantee covers →
3 · Commercial and invoicing
What is billed, and how
| Price model | One fixed campaign operating fee, plus a pre-agreed price per confirmed receipt and the consumer reward budget. Receipt validation technology is included in the platform; validation transactions are billed per confirmed receipt. |
|---|---|
| Invoicing entity | Promo Consulting Solutions GmbH, Berlin. |
| Reward budget | The consumer reward budget is held and settled separately from the operating fee. What is paid out to consumers is reconciled and evidenced at the end of the campaign. |
The price model in full: what the fixed operating fee includes and what sits outside it →
4 · Data protection
Roles, agreements, transfers
The short version for your assessment. The full detail, including the measures annex, is in the Trust Center.
| Roles | You are the controller, we are the processor. Where we act as controller — the contact data of your project team, or a cashback promotion we run in our own name — we say so in the contract rather than leaving it open. |
|---|---|
| Data processing agreement | Art. 28 GDPR, signed before any data flows. Covers purposes, data categories, retention, technical and organisational measures, subprocessors and audit rights. |
| Data protection officer | Appointed. Contact: info@competence-alliance.global. The name is published in the privacy notice, which is where Art. 37(7) GDPR puts it. |
| Hosting | Servers in the European Union. Every campaign runs in its own logically separated data set; where the campaign design or local law calls for it, a market runs in its own database. |
| International transfers | Standard contractual clauses, Module 2 controller-to-processor, with the UK addendum where UK data is involved and separate country annexes for markets such as Switzerland and Turkey that apply their own regimes. |
| Subprocessors | Listed in the agreement and engaged only with your prior consent. Member companies that hold shares in one another are listed and consented like any other subprocessor — the GDPR has no group exemption. Each one is assessed before engagement and bound by terms at least as protective as ours. |
| Breach notification | On becoming aware of, or reasonably suspecting, a personal data breach: within a defined, short window, typically 24 hours, with enough detail to meet your own reporting obligations. |
| Data subject requests | Passed to you within a short defined period, typically five business days, with our assistance in answering them. |
| End of engagement | Secure erasure or return at your choice, typically within 90 days of the end of processing, with written certification. |
| Audit rights | You can request the information needed to demonstrate compliance and audit the systems and premises where your data is processed. Findings are remediated on notice. |
Full detail, including the technical and organisational measures: FIBRE Trust Center →
5 · Information security
What protects the data
| Measures annex | The full technical and organisational measures form an annex to the data processing agreement and are provided on request. |
|---|---|
| Encryption | Campaign and participant data is encrypted in transmission and in storage. |
| Access control | Named individual accounts, strong authentication, least privilege, with auditing, logging and change control on any system that can reach personal data. |
| Support access | Measures are in place designed to prevent personal data from being readable in plain text for support or maintenance purposes, by our staff or by subcontractors. |
| Testing | Vulnerability assessments at least once a year, more often where a client or a regulator requires it. Summary findings are shared on request. |
| Resilience | A disaster recovery plan covering system backup, technology replacement and an alternate recovery site. Maintained and periodically tested. |
| Availability | Measured availability and a defined escalation path, not a published figure we cannot stand behind. Measured values are shared under NDA. A contractual availability SLA, where an engagement requires one, is named and priced into scope. |
| Certification | Not yet certified. We are implementing an information security management system aligned with ISO/IEC 27001, with the certification audit scheduled for spring 2027. The certificate goes on this site when we hold it, and not a day before. |
| Accessibility | Consumer-facing campaign pages are built to WCAG 2.1 AA: keyboard operation, colour contrast, labelled form fields and alternative text. |
6 · Compliance and conduct
How campaigns stay lawful
| Legal network | An independent licensed attorney in each of the 41 markets, engaged and paid by us. They draft the participation terms and sign off the mechanic before launch, in their own market and in their own language. |
|---|---|
| Our role | Competence Alliance is not a law firm and does not provide legal services. We coordinate; licensed counsel advises. That separation is deliberate and is reflected in the contract. |
| Participation terms | Always in the language of the market. In Belgium per language region; in Switzerland German and French, with Italian for Ticino. |
| Minimum age | Eighteen years across all 41 markets, regardless of whether a market would permit a lower age. |
| Permits and prize tax | Filed and settled per market before a campaign goes live. Rules by market → |
| Payout screening | Recipients of payouts are screened before money moves. Details of the process are provided as part of the vendor assessment. |
| Your code of conduct | Your supplier code of conduct and supplier declarations are reviewed during onboarding and signed where we can meet them. Where a clause does not fit our operating model, we say which one and why, rather than signing and hoping. |
| AI disclosure | Where imagery on our own website was composed with AI assistance, it is labelled on the page. Campaign material for clients follows the client’s own rules on this. |
7 · Operating record
Delivery record and current operating capability
| Period covered | Consumer promotions since 2010. The figures below cover that whole period; since 2016 the business has been operated by Promo Consulting Solutions GmbH. |
|---|---|
| Markets | 41 European markets. Coverage → |
| Platform | FIBRE® is the current-generation platform, built on 16 years of operating experience. It runs on EU-hosted infrastructure with data separated per campaign and, where required, per market. Promo Consulting Solutions GmbH controls the platform, its source-code repository and its product roadmap; the development companies involved have granted it the exclusive contractual rights required to operate, modify and further develop the source code. Current production metrics are available during procurement under NDA. |
| Capacity | 150+ specialists across the member companies, working in more than 20 languages. They are not exclusively assigned to one client; who staffs your campaign, in which role, is named in the offer. A licensed attorney covers each of the 41 markets, engaged and paid by us — name any market and we will put you in touch with that attorney before you sign. |
| Scale | Campaigns delivered, consumers reached and value distributed to consumers are published as estimates, with the method stated. The numbers → |
| Regulatory record | To our knowledge, no campaign we have coordinated has been stopped or prohibited by a regulator or court since 2016. We state this for the period we can evidence as Promo Consulting Solutions GmbH rather than for the full period since 2010. |
| Validation benchmark | In a documented 5,000-receipt benchmark, 95.5 % of receipts were decided automatically. That is a share decided without a person, not an accuracy rate: the remaining 4.5 % were flagged as uncertain and decided by trained reviewers before payout, not rejected. Methodology and error rates are available under NDA. |
Named client references are provided on request, with the client’s consent. Case studies → · The numbers →
8 · Contacts and escalation
Who to reach, and when
| Contract and commercial | Bernhard Mueller, PhD, Managing Director. +49 661 29191 488, info@competence-alliance.global |
|---|---|
| Data protection | Data Protection Officer, info@competence-alliance.global |
| Security questionnaires | Send them to info@competence-alliance.global. We answer them in writing, in full, before the campaign rather than during it. |
| Incident notification to you | Through the route named in the data processing agreement, to the contacts you designate there. |
| Escalation during a campaign | If something stalls, it does not queue behind an account layer. The managing director is reachable directly on the number above, and that is the same number a stuck payout or a delayed permit ends up at. |
9 · Documents
What we hand over — and what we do not have
The second half of this table matters as much as the first. A supplier that lists only what it holds is asking you to guess at the rest.
| Document | Availability | Note |
|---|---|---|
| Data processing agreement (Art. 28 GDPR) | On request | Before onboarding, for your legal review. |
| Technical and organisational measures | On request | Annex to the agreement. |
| Subprocessor list | On request | Also named in the offer. |
| Insurance certificate | On request | Before contract, with sums insured. |
| Commercial register extract | On request | Amtsgericht Hanau, HRB 99379. |
| Creditreform credit report | On request | Current report. |
| Vulnerability assessment summary | On request | Summary findings, not the raw report. |
| Disaster recovery plan summary | On request | As part of the vendor assessment. |
| Validation benchmark methodology | Under NDA | Including false positive and false negative rates. |
| SLA and availability figures | Under NDA | Measured values. A contractual SLA is priced into scope where required. |
| Named client references | On request | With the client’s consent. |
| ISO/IEC 27001 certificate | Not held | Certification audit scheduled for spring 2027. |
Send us your questionnaire before the campaign, not during it.
Data processing agreement, measures annex, subprocessor list and insurance certificate are ready to go out.