Privacy Policy

1. Introduction

Vulnus is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Dutch privacy law. This Privacy Policy explains what data we collect, how we use it, and your rights as a data subject.

Data controller: Vulnus, Amsterdam, Netherlands. Contact: contact@vulnus.io

2. What Data We Collect

• Contact form submissions: full name, company name, email address, website/domain, and any information you provide in the form fields.
• Email communications: any data you share when contacting us directly.
• Security engagement data: domain names, scan targets, and technical findings as part of contracted security engagements.
• We do not collect payment data directly. Payments are processed via bank transfer.
• We do not use cookies, tracking pixels, or analytics tools on vulnus.io.

3. How We Use Your Data

• To respond to enquiries submitted via our contact form.
• To deliver contracted security testing services.
• To send invoices and engagement documentation.
• To comply with legal obligations under Dutch and EU law.
• We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

• Contract performance: processing necessary to deliver our services to you.
• Legitimate interest: responding to enquiries and managing business relationships.
• Legal obligation: retaining records as required by Dutch tax and business law.

5. Data Retention

• Contact enquiries: retained for 12 months from last contact.
• Client engagement data: retained for 7 years as required by Dutch tax law.
• Security findings and reports: deleted within 30 days of report delivery unless otherwise agreed.

6. Your Rights

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request correction of inaccurate data.
• Right to erasure: you may request deletion of your data where no legal obligation requires retention.
• Right to restriction: you may request we limit processing of your data.
• Right to object: you may object to processing based on legitimate interest.
• To exercise any of these rights, contact us at contact@vulnus.io.
• You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

7. Data Security

• We implement appropriate technical and organisational measures to protect your personal data.
• All client data and security findings are transmitted and stored securely.
• Access to client data is restricted to authorised personnel only.

8. Contact

For any privacy-related questions or requests, contact us at: contact@vulnus.io