Privacy policy

1. Controller

The controller of personal data is , trading as , , tax ID (NIP) . Contact for personal data matters: .

The controller has not appointed a data protection officer; the law does not require one at this scale and nature of processing.

2. What data we process

1. User account data: first and last name, business e-mail address, business phone number, job title, the Client's company name, notification settings, date and version of the accepted terms.
2. Authentication data: the password as a cryptographic hash, the authenticator-app secret or passkey public key, sign-in information (date, IP address, browser).
3. Data of the Client's contact persons named in the agreement: name, job title, e-mail, phone.
4. Content entered into the Portal: messages, notes, product data and component lists (SBOMs), decisions and assessments, reports. Product data and SBOMs as a rule contain no personal data.
5. Event log: who performed which action in the Portal and when (e.g. sign-in, file upload, decision, report publication, notification confirmation).
6. The Client's billing data needed to issue invoices.
7. Data from the public “Book a free call” form: name, company, job title, business e-mail and phone, product information, proposed times, message text, form language, how you heard about us, and the date and text of the consent given.

3. Purposes and legal bases

1. Keeping accounts and providing the services covered by the agreement with the Client, including vulnerability monitoring, preparing reports, communication and e-mail and SMS notifications: performance of the contract with the Client (Article 6(1)(b) GDPR) and, for Users who are employees or contractors of the Client, the legitimate interest of the controller and the Client in performing the agreement (Article 6(1)(f) GDPR).
2. Securing the Portal, authentication, abuse detection and keeping the event log: the controller's legitimate interest (Article 6(1)(f) GDPR) and the obligation to ensure security of processing (Article 32 GDPR).
3. Documenting the Client's compliance with the Cyber Resilience Act (order log, notification confirmations): the legitimate interest of the controller and the Client (Article 6(1)(f) GDPR).
4. Billing, accounting and taxes: the controller's legal obligation (Article 6(1)(c) GDPR).
5. Establishing, pursuing and defending claims: the controller's legitimate interest (Article 6(1)(f) GDPR).
6. Replying to a “Book a free call” request, arranging and holding the presentation and preparing an offer: the requester's consent (Article 6(1)(a) GDPR), which may be withdrawn at any time, and steps taken at the requester's request before entering into a contract (Article 6(1)(b) GDPR). The form is not used for newsletters or other marketing content.

We make no decisions based solely on automated processing and do not profile Users. Automatic notifications (e.g. an SMS about an urgent vulnerability) are part of the service, not a decision producing legal effects on a person.

4. Where the data comes from

We receive data from the Client (the User's employer or principal) when concluding the agreement and creating accounts, from a User inviting further persons, from the User while using the Portal, and from the person filling in the “Book a free call” form.

5. Recipients

Data may be passed to processors acting on our instructions, only to the extent necessary to provide the service and under data processing agreements:

1. hosting and server infrastructure providers (data centres in the European Union),
2. the transactional e-mail provider (e-mail notifications),
3. the SMS provider (notifications about urgent matters),
4. the backup storage provider (a second region in the European Union),
5. the accounting office, for billing data.

Data may be disclosed to public authorities where the law requires it. We do not sell data and do not share it with other clients. We do not transfer data outside the European Economic Area.

6. How long we keep data

1. User account data: for the term of the agreement with the Client and 30 days after it ends; an account removed by the Client is deactivated immediately, while its entries in the event log remain under the rules below.
2. Event log, reports and notification confirmations: for the term of the agreement and then until claims become time-barred (as a rule 6 years), or longer if the Client requests their retention as evidence of compliance with legal obligations.
3. Sign-in data and IP addresses: 12 months.
4. Messages and notes: for the term of the agreement and 30 days after it ends.
5. Billing data: 5 years from the end of the tax year in which the document was issued.
6. “Book a free call” requests: until the talks end, no longer than 12 months from the request unless a contract is concluded; a demo account created for the presentation is deleted 90 days after the presentation if no contract is concluded.

7. Rights of data subjects

Every person has the right to:

1. access their data and receive a copy,
2. rectification,
3. erasure, where there is no longer a basis for processing,
4. restriction of processing,
5. portability of data processed under a contract by automated means,
6. object to processing based on legitimate interest, on grounds relating to their particular situation,
7. lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

Requests may be sent to . We respond without undue delay, at the latest within one month. We may ask for identity confirmation so as not to disclose data to an unauthorised person. Some data (e.g. event-log entries) must be retained despite an erasure request where the law or the defence of claims requires it; in that case we explain the reason.

8. Cookies and browser storage

The Portal uses no marketing, analytics or third-party cookies. It uses only necessary browser storage: the session identifier after sign-in (removed at sign-out or when the browser is closed), the remembered interface language and theme, and the dismissal of notices. These are needed for the Portal to work and require no consent.

9. Data security

1. multi-factor authentication (MFA) on every account; sessions expire after 30 minutes of inactivity,
2. isolation of each company's data at the database level (Row-Level Security),
3. encryption in transit (TLS) and at rest; SBOMs and reports additionally encrypted with a key assigned to the company,
4. backups encrypted and stored in a second European Union region,
5. a tamper-evident event log,
6. e-mail notifications without vulnerability details (only a link to the Portal),
7. security testing of the Portal before launch and after material changes.

In the event of a personal data breach likely to result in a risk to data subjects, we notify the Client without undue delay and the supervisory authority within 72 hours, in accordance with Articles 33 and 34 GDPR.

10. Changes to this policy

We update the policy when the law, our processors or the way the Portal works change. We inform about material changes in the Portal and by e-mail. The current version is always available in the Portal with its effective date.