GDPR

Last updated: 18 September 2026

For visitors and candidates

If you contacted us through a form or applied for a job, your data is processed as described in our privacy policy. You can exercise your rights at any time by writing to [email protected].

For clients: we act as a processor

When we administer your servers, run a SOC service, perform an audit or carry out penetration tests, we usually process personal data on your behalf as a processor within the meaning of Art. 28 GDPR. In that case:

• we sign a data processing agreement before the work starts;
• we process data only on your documented instructions and only to the extent needed to deliver the service;
• everyone with access is bound by confidentiality obligations;
• we keep a register of processing categories and a list of sub-processors, which we share on request;
• we support you with data subject requests, security incidents and audits, including the audit rights required by DORA Art. 30.

Security measures

Our organisational and technical measures follow ISO 27001 practice and include:

• access control on a least-privilege basis, with multi-factor authentication for administrative access;
• encryption of data in transit and encryption of backups;
• network segmentation, hardening and vulnerability management;
• 24/7 monitoring with logging and defined incident escalation paths;
• regular penetration tests and recovery tests of backups.

Personal data breaches

If a breach occurs in a service we deliver, we notify you without undue delay, with the information you need for your own notification to the supervisory authority within 72 hours. To report a suspected incident, write to [email protected] or use the 24/7 contact details in your SLA contract.

Documents on request

We provide the following to clients and prospective clients: our data processing agreement template, the list of sub-processors, our information security policy summary and completed vendor security questionnaires. Ask at [email protected].