Privacy Policy

1. Data controller

The data controller is SYSDEVOPS.EU Jarosław Karsznia, ul. Zbożowa 5/34, 81-020 Gdynia, Poland, Tax ID (NIP): 5871592779.

Contact: [email protected]

2. Analytics - Umami

The public website (landing page and CVE catalog) uses Umami Analytics - a web analytics tool that does not use cookies and does not collect personal data. Umami processes only anonymized statistical data (device type, country, visited pages, clicks on links such as "Start free trial"). Using Umami does not require user consent under GDPR or the Polish Electronic Communications Law. Analytics also covers contact page views and the successful form submission event, without including form content in that event.

Analytics tracking runs only on the public website (landing page and CVE catalog). The login panel and the dashboard for authenticated users do not include this script.

3. Cookies

This public CVE catalog does not use any tracking or marketing cookies. The part of the application that requires logging in uses session cookies necessary for authentication. Sections 4 and 5 describe data processing related to registration and access security.

When you begin using the contact form or the registration form (clicking or focusing any element inside the form, including its fields, links and the submit button), the page loads the Cloudflare Turnstile script, which reads technical data of the browser and device to tell a person from a bot. Reading the page or opening the privacy policy does not start the verification. For access to information on your device necessary to securely provide the form you have started to use, we do not ask for consent: we rely on the exemption in Article 399(3)(2) of the Polish Electronic Communications Law. Cloudflare also uses these signals to improve its bot detection as an independent controller (section 8). Details in sections 5 and 7.

4. Trial account users

When you register for a free trial we process the data you provide (e-mail address, company name, NIP or EU VAT number) and account data needed to deliver the Service, on the basis of performing the agreement (GDPR Art. 6(1)(b)). After moving to a paid plan, we also process billing data to fulfil our legal obligations - issuing invoices and keeping accounting records (GDPR Art. 6(1)(c)).

5. Registration and access security (anti-abuse)

At registration we store the IP address from which the account was created (signupIp). We use it solely to prevent abuse of open registration - for example to limit mass automated account creation from a single address. The legal basis is our legitimate interest in protecting the Service (GDPR Art. 6(1)(f)).

The registration form uses Cloudflare Turnstile. The verification starts only when you begin using the form, not when you open or read the page. To check that the form is filled in by a person, Cloudflare processes technical data of your browser and device, including the IP address. The legal basis is our legitimate interest (GDPR Art. 6(1)(f)) in protecting registration from automated account creation. Without this check the form will not accept a registration; if you cannot pass it, or you object, write to [email protected]. Cloudflare and the transfer of data to it are described in section 8.

Unconfirmed accounts: if no user of the account confirms their e-mail address, we delete the account in the daily cleanup after 7 days from registration, provided it is not a demo account or an account with unlimited access, is not billed manually, and has no machines, no valid unaccepted invitation, no Stripe customer or subscription identifier and no recorded paid-through date. We then delete the user record from the database (e-mail address, password hash, record of acceptance of the terms), unless that user belongs to another account, and we remove the company name, the tax identifier (NIP or EU VAT) and the registration IP address from the account record. What remains is the technical account record described in section 9.

Access denial log: when a logged-in user (including in the demo account) requests by identifier a resource (for example a machine, project, incident or team member) that does not belong to their account or does not exist, we record the refusal: the user and account identifiers, the IP address, the request method and path, the type and identifier of the resource, and the time. We use the log to detect attempts at unauthorised access to other customers' data, to respond to them and to investigate security incidents. A series of refusals triggers a notification to the operator by e-mail and Telegram (recipients in section 8); we delete copies of these notifications after 12 months. The legal basis is our legitimate interest in the security of the Service and of the data entrusted to us (GDPR Art. 6(1)(f)). We delete the entries in the daily cleanup after 90 days.

Detection of probing: when a request looks like a search for weaknesses or secrets of the website, for example a request for a path not needed in normal use of the Service or the use of invalid credentials typical of such attempts, we may notify the operator by e-mail, even after a single request (recipients in section 8). With a logged-in session the e-mail contains the user and account identifiers, the account type, the IP address, the request path and the number of access denials for that user in the last 10 minutes. Without a session it contains the IP address and the request path. Telegram receives only a signal that such an e-mail was sent, without this data. We do not record these events in the Service database; only copies of the notifications remain, and we delete them after 12 months. This serves to detect attacks and compromised sessions and keys, to respond to them and to investigate security incidents. The legal basis is our legitimate interest in the security of the Service and of the data entrusted to us (GDPR Art. 6(1)(f)). A notification alone does not establish abuse and does not automatically block an account.

6. Partner programme applications

The partner programme form collects: full name, e-mail address, type of applicant (certifying auditor or consultant), and optionally company name, a link to a public profile (LinkedIn or website) and a free-text note. We also store the exact wording of the consent you ticked, the time it was given, the IP address the form was sent from and the language of the page.

The application data is processed on the basis of your consent (GDPR Art. 6(1)(a)), given in order to review the application and contact you about it. You can withdraw the consent at any time by writing to [email protected]; withdrawal does not affect the lawfulness of processing before it. The IP address is stored on the basis of our legitimate interest (GDPR Art. 6(1)(f)) - it caps the number of applications sent from one address.

Retention: we delete a rejected application record from the database 90 days after the decision, or 90 days after it was submitted if no decision date was recorded. An application still awaiting a decision stays in the queue until it is decided. An accepted application is kept until the data of the account created on its basis is deleted - it is the basis of that account and the record of what exactly was consented to. The IP address is erased 90 days after the form was sent, regardless of the status of the application.

A notification about a new application goes to the operator by e-mail (sent through Resend to the operator's mailbox at Hostido) and as a Telegram message. It contains the name, e-mail address, type of applicant and, if given, the company and the profile link. The transfer of data to Telegram is not covered by safeguards under GDPR Art. 46 (details in section 8). We delete notification copies from the operator's mailbox and from Telegram 12 months after the application was sent; database backups are described in section 7.

7. Contact form

The contact form collects: full name, e-mail address, topic, the message and optionally company name. We also store the IP address the form was sent from, the language of the page, the message identifier and delivery information. Providing data is voluntary and is not a statutory requirement. Without the full name, e-mail address, topic and message the form cannot be submitted and we cannot reply. The company name is optional.

We process the form data to handle your enquiry and reply, and after replying to be able to refer back to the correspondence until the end of the retention period. The legal basis is our legitimate interest in corresponding with people interested in Secvalis (GDPR Art. 6(1)(f)). Where we take steps at your request before entering into a contract to which you would be a party (for example a quote), we process the data necessary for those steps under GDPR Art. 6(1)(b). We retain correspondence needed to establish, exercise or defend legal claims based on our legitimate interest in protecting those claims (GDPR Art. 6(1)(f)). The IP address is stored on the basis of our legitimate interest (GDPR Art. 6(1)(f)): it caps the number of messages sent from one address and helps us investigate abuse. You may object to processing based on our legitimate interest on grounds relating to your particular situation by writing to [email protected].

Anti-spam protection: the form uses Cloudflare Turnstile. The verification starts only when you begin using the form (clicking or focusing any element inside it), not when you open or read the page. To check that the form is filled in by a person, Cloudflare processes technical data of your browser and device, including the IP address. The legal basis is our legitimate interest (GDPR Art. 6(1)(f)) in protecting the form from automated spam. Cloudflare and the transfer of data to it are described in section 8.

A notification containing the full name, e-mail address, topic, message content, optional company name and message identifier goes to the operator by e-mail (sent through Resend to the operator's mailbox at Hostido) and as a Telegram message. Telegram Messenger Inc. is established outside the European Economic Area and the transfer to it is not covered by safeguards under GDPR Art. 46 (details in section 8). If you do not want your message to reach Telegram, write directly to [email protected] instead of using the form. We reply from our own mailbox to the e-mail address you gave.

Retention: we delete the message record from the contact form database in the daily cleanup after 12 months (365 days) from sending. We delete notification copies and further correspondence about the message from the operator's mailbox and from Telegram 12 months after the message was sent, unless the correspondence leads to a contract; then we keep it in the operator's mailbox for the duration of the contract and until claims become time-barred. We remove the IP address from the database record 30 days after sending. Encrypted backups cover the whole database, including the form data and IP addresses present in the database when each backup was made. We keep backups from the last 7 days, 4 weeks and 6 months in which a backup was made (these periods overlap) and remove older ones through rotation, so a deleted message or IP address usually remains in backups for up to 6 more months; interruptions in backups may extend this. If you ask us to delete your message earlier, write to [email protected].

8. Data recipients

To deliver the Service and handle correspondence we use the following data recipients. Processors act on our behalf; where a recipient also processes data for its own purposes, we say so in its entry. A copy of the transfer safeguards mentioned below can be requested at [email protected].

• Resend (Plus Five Five, Inc., USA) - sending transactional emails (account verification, notifications) and operator notifications about contact form messages, new registrations (company name, e-mail address), access denial series (user and account identifiers, IP address, request path, resource identifier) and suspected probing (scope in section 5). Data processed: email address; for the contact form also the full name, topic, message content, optional company name and message identifier. Transfers to the USA are based on the standard contractual clauses in Resend's data processing agreement (https://resend.com/legal/dpa); Resend also participates in the EU-U.S. Data Privacy Framework.
• OVHcloud (OVH SAS, region - Warsaw, Poland) - storage of encrypted backups. Backups are encrypted (restic) before being sent, so OVHcloud has no access to the data in plaintext.
• Error reporting (GlitchTip) is self-hosted on our own server in Poland - not a separate third-party processor. Error reports may contain technical data needed for diagnostics.
• Cloudflare (Cloudflare, Inc., USA) - reverse proxy and network protection for the whole website, and the Turnstile anti-bot check on the contact form and the registration form. All traffic to the website passes through Cloudflare, which processes IP addresses and HTTP request data, including data submitted through forms, as needed to deliver and protect the traffic. For Turnstile it processes technical data of the browser and device, including the IP address; when improving its own bot detection Cloudflare acts as an independent controller (https://www.cloudflare.com/turnstile-privacy-policy/). Transfers to the USA rely on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework, within the scope of Cloudflare's certification, and otherwise on the standard contractual clauses in Cloudflare's data processing agreement (https://www.cloudflare.com/cloudflare-customer-dpa/).
• Hostido (HOSTIDO.PL Gałązka Spółka Jawna, Gdańsk, Poland) - the operator's mailbox ([email protected]), which receives form and security notifications and is used for correspondence. Data stays in Poland.
• Telegram (Telegram Messenger Inc., British Virgin Islands, outside the European Economic Area) - the messenger through which the operator receives notifications. Contact form notifications contain the full name, e-mail address, topic, full message, optional company and message identifier. Partner programme notifications contain the full name, e-mail address, applicant type, optional company and profile link, without the note or the consent record. A new registration notification contains the company name and the registrant's e-mail address. An access denial series notification (section 5) contains the user and account identifiers, the IP address, the request method and path, and the type and identifier of the resource. A suspected probing notification (section 5) is only a signal, without personal data. Notifications also include a link to the admin panel. We have not entered into a data processing agreement or standard contractual clauses with Telegram, so this transfer is not covered by safeguards under GDPR Art. 46, and the European Commission has not issued an adequacy decision for the British Virgin Islands. Telegram describes its own processing at https://telegram.org/privacy. If you do not want your data to reach Telegram, write directly to [email protected] instead of using a form. This option applies to form messages, not to registration and security notifications.
• Hosting infrastructure: OVHcloud (OVH SAS), servers located in Warsaw, Poland.

9. Data retention

Personal data is stored for the following periods:

• Account and user data (including the e-mail address, machines and scan results, projects, the audit log, incidents, frozen reports and the team) - for as long as the Account is maintained. After the Account owner requests deletion there are 30 days to cancel it; once they pass, we delete this data in the daily cleanup run. If the Account has a subscription, we end it first. If ending the subscription or the deletion fails, we retry in the following daily runs. The record of a user who also belongs to another account stays, and only their membership in the deleted Account is removed;
• Billing register (entries about payments and invoices: the buyer details, that is name, NIP or EU VAT number, address and country, and for payments made through Stripe also the e-mail address; amounts, transaction identifiers and operator notes) - for as long as the Account exists, and after the Account is deleted until 1 January of the seventh year after the year of the entry date. An entry dated in 2026 is deleted in a daily cleanup run from 1 January 2033 onwards, once the Account has been deleted. The entry date is the invoice issue date or, if there is none, in this order: the payment date, the end of the billing period, the date the entry was created; the year is counted in Polish time. We issue VAT invoices outside the Service and keep their archive separately, as tax law requires;
• Technical record of a deleted Account (the Account identifier, status, dates, technical and billing settings, and the Stripe customer and subscription identifiers; without the company name, tax identifier, address or IP address) - we keep it so that a payment arriving after the deletion does not recreate the Account and so that we can end the subscription. We delete it together with the last billing register entry of that Account. The record of a deleted Account that never had a billing register entry has no set deletion date at present. Deleting the Account in the Service does not delete the customer and payment data held by Stripe, our payment provider;
• Registration IP address - for the period necessary for security and anti-abuse purposes, no longer than 12 months from registration or until an effective objection is raised;
• Data of an account whose e-mail address was not confirmed (user record, company name, tax identifier, registration IP address) - 7 days from registration, then deleted on the terms described in section 5 (the record of a user who belongs to another account stays); copies of the registration notification in the operator's mailbox and Telegram - 12 months; database backups - as described in section 7;
• Access denial log (including the IP address) - 90 days from the entry, then deleted, also when the Account it concerns was deleted earlier; copies of access denial series notifications in the operator's mailbox and Telegram - 12 months; database backups - as described in section 7;
• Suspected probing notifications - copies are deleted 12 months after sending; these events are not recorded in the Service database.
• Rejected partner programme application (database record) - 90 days from the decision (or from submission, if no decision date was recorded), then deleted; notification copies in the operator's mailbox and Telegram - 12 months from submission; database backups - as described in section 7;
• Accepted partner programme application - until the data of the account created on its basis is deleted;
• IP address the partner programme form was sent from - 90 days from sending, regardless of the status of the application;
• Contact form message - the database record is deleted in the daily cycle 365 days after sending; notification copies and further correspondence in the operator's mailbox and Telegram are deleted 12 months after sending, unless the correspondence leads to a contract (then it is kept in the mailbox for the duration of the contract and until claims become time-barred); database backups - as described in section 7;
• IP address the contact form was sent from - 30 days from sending (database record); database backups - as described in section 7.

Data deleted from the database remains in encrypted backups until they are rotated out, as described in section 7.

10. Your rights

Under GDPR (Articles 15–21) you generally have the right to access, rectify, erase and restrict processing of your personal data, the right to data portability where processing is automated and based on consent or contract, the right to object to processing (in particular against processing based on our legitimate interest, e.g. handling contact form messages, the Turnstile check, storing the IP address or the access denial log), as well as the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

In practice, these rights do not apply to the analytics data described above: Umami does not collect any personal data, so there is no personal data of yours for us to access, rectify, or delete in this context.