SecVault Auditor privacy policy
In case of any discrepancy, the Polish version is binding. GDPR below means Regulation (EU) 2016/679.
Controller
The data controller is the owner of the SecVault service. Contact on data matters, including a request for the controller's full details: [email protected].
What data and why
- Free audit: the domain name and the scan result, and your email address if you give it. Instead of an IP address we store a hash that changes every day and does not allow the address to be recovered; it is used for rate limits and abuse protection. Basis: our legitimate interest (Art. 6(1)(f) GDPR) in providing and protecting the service.
- Link to the result by email: if you give an address with the scan, we send one message with a link to the result, with no offer. We send further messages with results only after you confirm the address with a button on the result page. Every message has an unsubscribe link. Basis: your request and our legitimate interest (Art. 6(1)(f) GDPR).
- Signing up for a list or for tips by email: the email address and the text of the consent, based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Ordering a report: email, company name, tax ID (NIP), order number, payment data. Basis: contract (Art. 6(1)(b) GDPR) and tax obligations (Art. 6(1)(c) GDPR).
How long
- Results of free scans: 90 days.
- Email address given with a scan, without consent to tips: 90 days.
- Address on a list and the consent: until the consent is withdrawn.
- Paid orders: 5 years from the end of the tax year (tax law). Unpaid orders: 30 days.
- IP address hashes in rate-limit counters: 7 days.
- Queue of messages with a link to the result: 30 days. After you unsubscribe, only a hash of the address stays on the "do not write" list.
Who receives the data
The data sits on a server rented from OVH (European Union). Traffic to the site passes through Cloudflare, Inc. (protection and acceleration of the site; a US company, data transfer based on the Data Privacy Framework). We send mail from our own server. We do not sell data and do not use it for advertising.
Cookies and statistics
Public pages do not set cookies. We collect visit statistics with Umami, without cookies and without identifying people. If you pick a theme (light or dark) by hand, your browser remembers it in local storage (key audytor-motyw); this information does not reach us.
Your rights
You have the right of access to your data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent. Write to [email protected]. You can also lodge a complaint with the President of the Personal Data Protection Office (UODO).