Privacy notice

1. Purpose of this platform

The platform collects and evaluates information about the cyber security of client companies and their partner organizations (regional and local partners) in order to assess and strengthen their compliance with cyber security standards and with the requirements of the respective company.

2. Which personal data we process

• Account data: name, business e-mail address, phone number, job title, organization, preferred language.
• Security data: login times, IP address, browser information and an audit trail of actions.
• Evidence documents may incidentally contain personal data. Please remove or mask personal data that is not required before uploading.

Assessment answers relate to organizations, not to individuals.

3. Legal basis

Art. 6(1)(b) GDPR (providing the platform to authorized users) and Art. 6(1)(f) GDPR (legitimate interest in the security of the partner network). Where national law applies (e.g. KVKK in Türkiye), the corresponding provisions apply.

4. Recipients

Authorized users of your company and of the partner organizations above you, according to their permissions, and the platform operator. Service providers (hosting, e-mail and - if enabled - AI services) act as processors under data processing agreements. AI services only receive aggregated or pseudonymized data or the evidence they are asked to check; your company may require a local AI model.

5. Storage period

Account data is kept while the account is active; deleted accounts are anonymized. Security logs and evidence are deleted according to the retention policies published in the platform.

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. You can exercise these rights in your profile ("My data") or by contacting the data protection contact. You also have the right to lodge a complaint with a supervisory authority.

7. Hosting

The platform and its data are hosted in the European Union.