Privacy Policy

This is a translation for convenience. Only the German version is legally binding.

Draft. This privacy policy is a draft and will be reviewed by a lawyer or data protection officer before going live (GDPR/BDSG).

1. Controller

2715573 Alberta Corporation, 1706-530 3 St SE Calgary, Alberta T2G 2L8 Kanada, tim@itsecurityon.com.

2. Hosting

We operate the website, customer area, database and the automated checks on servers in Germany. The hosting provider processes the data exclusively on our behalf and in accordance with our instructions (data processing on behalf pursuant to Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of our services.

3. Server log files

Each time our website is accessed, the web server automatically stores information transmitted by your browser: IP address, date and time, requested address, status code, amount of data transferred, the previously visited page (referrer) and browser and operating system (user agent). We use this information only to ensure operation and to detect and defend against faults or attacks. The log files are limited in size and are continuously overwritten. To prevent misuse, we also count requests per IP address (e.g. for free checks); these counters expire after one hour at the latest. The legal basis is Art. 6(1)(f) GDPR.

4. Cookies

We only use technically necessary cookies: a session cookie for signing in to the customer area, a security cookie that protects forms against forged requests, and a cookie that stores your chosen language (for up to one year). We do not use tracking, analytics or advertising cookies. The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) and (f) GDPR.

5. Processing in connection with our services

We process the data you provide (e.g. email address, company, domains to be tested) in order to provide the services ordered or requested free of charge (Website & Server Check, data breach monitoring, phishing & awareness). The legal bases are Art. 6(1)(b) and (f) GDPR.

6. Payment processing

We process card and direct debit payments via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). In doing so, the data required for the payment is transmitted to Stripe. For payment by invoice, we process the invoice data ourselves. The legal basis is Art. 6(1)(b) and (c) GDPR.

7. Sending emails

We send emails – for example sign-in links, check results, invoices, notifications and the test phishing emails of awareness campaigns – via Amazon Simple Email Service (Amazon SES) of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, with a data centre in the EU. In doing so, the recipient address, content and technical delivery data are processed. Amazon acts as a processor. A transfer to the USA cannot be ruled out; Amazon is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) and (f) GDPR.

8. AI assistance

An AI service from OpenAI may be used for individual functions: to categorise enquiries we receive, to pre-check publicly accessible legal texts of a website and to present check results in an understandable way. Only the content required for the respective task is transmitted. A transfer to the USA cannot be ruled out. The legal basis is Art. 6(1)(b) and (f) GDPR.

9. Website tests and data breach checks

For free checks, we process the domain and email address provided. Data breach checks compare the domain against our own database of known data breaches. We only carry out tests on systems for which you have confirmed your authorisation to us.

10. Address and company suggestions (Google Places)

If you use the “Search address” field when ordering or type your company name when registering, our server transmits the text entered to the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in order to suggest matching addresses or companies. If you select a company suggestion when registering, our server only retrieves the website stored for it in order to pre-fill the “Your website” field. Your browser does not connect to Google in this process; your IP address and cookies are not transmitted to Google. Use of this feature is voluntary – you can also enter the address, company and website without searching. The legal basis is Art. 6(1)(b) and (f) GDPR (simple and accurate capture of the billing address and company details). A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework.

11. Retention period

We only store personal data for as long as is necessary for the respective purpose. We store account and contract data for the duration of the customer relationship; after the account is deleted, they are deleted unless statutory retention obligations apply. We keep invoices and other accounting-relevant documents for the period prescribed by law (up to ten years under German commercial and tax law). Sign-in links expire after a short time and are then deleted automatically.

12. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority.