Privacy Policy

Digitpol BV, headquartered in Apeldoorn, the Netherlands, is responsible for personal data used to operate this penetration testing suite. Our main company website is digitpol.com. Contact [email protected] for privacy enquiries.

For customer assessment data processed on your instructions, our role and responsibilities depend on the engagement agreement and any applicable data processing agreement. This notice does not replace those agreements.

Account and enquiry information includes your name, organisation, email address, optional telephone number, requested services, scope, timeline and messages. Client records include quotes, orders, payment references, report delivery preferences and account administration records.

Engagement records may include authorised domains and IP addresses, system descriptions, assessment findings, reports and certificates. Electronic NDA records include the representative's identity, organisation, position, signature, agreement reference, signing time and IP address. Do not enter passwords, private keys or other secrets in public forms or portal messages.

Technical records include request IP addresses, approximate country, browser information, visited paths, referring pages, session identifiers and authentication or administrative events. Quick scans record the authorised target, public findings, authorisation confirmation and a hashed identifier derived from request IP and browser information for abuse prevention.

We use enquiry, account and engagement information to respond to requests, take steps towards a contract, deliver agreed assessments, manage payment and communicate with customers. The applicable basis is performance of a contract or requested steps before entering one, where relevant to the individual concerned.

We rely on legitimate interests to administer business contacts, protect systems, prevent scan misuse, investigate security events and understand website operation. We use records to meet applicable legal obligations, including relevant accounting requirements. Where processing requires consent, it must be obtained separately and may be withdrawn without affecting earlier lawful processing.

DigitalOcean hosts the public deployment. Lovable Cloud provides account and application data services. Stripe processes payments on its own payment pages; the suite stores transaction and checkout references rather than full card details. Authorised personnel and service providers access information as needed for delivery, support and security.

Public domain research can query Cloudflare DNS, domain registration services, ipwho.is and crt.sh, and contact the authorised target. Relevant domain or IP queries are disclosed to those services. Google Fonts supplies website fonts and receives the network information needed to serve them.

Approved certificate verification exposes certificate information to anyone holding its verification hash, including organisation, target, assessment, outcome and testing dates. Share a verification link only when you intend the recipient to see that information. We may also disclose records where required by law or necessary to establish, exercise or defend legal claims.

Providers may process information outside the Netherlands or the European Economic Area. Where an international transfer is subject to GDPR restrictions, an applicable transfer mechanism is required, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about the safeguards relevant to your engagement.

Retention depends on the record, engagement, applicable legal requirements and the need to investigate security incidents or preserve evidence. Contractual, accounting and audit records may need to be retained after an engagement ends. Contact us for the retention period applicable to a particular record; this notice does not promise a universal deletion deadline.

Access controls, authorised workflows and confidentiality arrangements protect customer records. No website or communication channel can guarantee absolute security. Removal of a record from an active system may not immediately remove retained backups or records required for legal purposes.

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability of personal data, and object to processing based on legitimate interests. You may withdraw consent where it is the basis for processing. Send requests to [email protected], identifying the relevant account or engagement. We may need to verify your identity before acting.

You may complain to the Dutch data protection authority, Autoriteit Persoonsgegevens, or another competent supervisory authority. Its website is autoriteitpersoonsgegevens.nl. You may contact us first so we can address your concern.

Our Cookie Policy explains cookies and browser storage used for sign in, preferences and website monitoring. External sites and payment pages have their own privacy notices. We update this notice when relevant practices change.