Privacy notice

The controller responsible for data processing on this site is the service provider named in the imprint. Contact details are given there and repeated below.

This site is hosted by Vercel Inc. in the United States. When you access a page, your browser transmits data that is stored temporarily in server log files: IP address, date and time of the request, the page requested, referrer URL, browser and operating system. This is technically necessary to deliver the site and to maintain its security and stability.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in operating a secure and functional website.

Because our hosting provider is based in the United States, personal data may be transferred there. The transfer is safeguarded by the EU-US Data Privacy Framework and, in addition, by the European Commission’s standard contractual clauses. US authorities may in principle be able to access data, and you should be aware of this residual risk.

The questionnaires and the contact form on this site are provided by Tally BVBA, Belgium. When a page containing a form is loaded, your browser connects to Tally’s servers, which requires transmitting your IP address. Tally is based in the EEA, so no third-country transfer arises from this.

What you enter — typically your name, email address, company, and the details you give about your product and its security processes — is processed to answer your enquiry and to produce your assessment result. Please do not submit confidential technical details or trade secrets through the form; use encrypted email if you need to share those.

Legal basis: Art. 6 (1) (b) GDPR where the processing serves a pre-contractual enquiry, and Art. 6 (1) (a) GDPR where you have given consent by submitting the form. A data processing agreement under Art. 28 GDPR is in place with the provider.

The following providers process personal data on our behalf. Each is bound by a data processing agreement.

• Tally

  Company

  Tally BVBA, Belgium

  Purpose

  Questionnaire and contact form delivery

  Location

  EEA — no third-country transfer

  Privacy policy

  tally.so/help/privacy-policy

• Vercel

  Company

  Vercel Inc., United States

  Purpose

  Website hosting and content delivery

  Location

  Third country — safeguarded by DPF and standard contractual clauses

  Privacy policy

  vercel.com/legal/privacy-policy

This site sets no analytics or advertising cookies. The form provider may set cookies that are technically necessary to operate the form and prevent abuse. No cross-site tracking or profiling takes place.

Server log files are retained only as long as needed for security analysis. Enquiry and assessment data is retained for as long as needed to handle your enquiry and any resulting engagement, after which it is deleted unless statutory retention periods under commercial or tax law require otherwise.

Under the GDPR you have the following rights in respect of your personal data. To exercise any of them, contact us using the details in the imprint.

• Access (Art. 15)

  To be told whether we process data about you, and to receive a copy of it.

• Rectification (Art. 16)

  To have inaccurate data corrected and incomplete data completed.

• Erasure (Art. 17)

  To have your data deleted where there is no lawful ground to keep it.

• Restriction (Art. 18)

  To have processing restricted while a dispute about accuracy or lawfulness is resolved.

• Data portability (Art. 20)

  To receive data you provided in a structured, machine-readable format.

• Objection (Art. 21)

  To object to processing based on legitimate interests, including at any time and without giving reasons where direct marketing is concerned.

• Withdraw consent (Art. 7 (3))

  To withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

• Lodge a complaint (Art. 77)

  To complain to a supervisory authority, in particular in the member state of your residence or workplace.

You may lodge a complaint with the data protection authority of the federal state in which the controller is established, or with the authority in your own place of residence.

No data protection officer is appointed. The statutory thresholds in § 38 BDSG — in particular twenty or more persons permanently engaged in automated processing — are not met.