Privacy Policy

1. Who we are

The data controller is VAULT APPS SRL, tax ID 37880060, Trade Register J29/1679/2017, registered office Str. Cireșoaia nr. 15, Ploiești, Prahova County, Romania. Defneo is the brand under which we offer the platform.

For any question about your data, write to office@vaultapps.ro. We are not legally required to appoint a data protection officer (DPO); requests are handled directly by the company's management.

For the data customers put into Defneo Cloud (compliance registers, agent inventory and so on) we are not the controller but a processor: the customer decides. That relationship is set out in the Data Processing Agreement (DPA).

2. The website and its forms

The site's forms (NIS2 scope check, checklist, newsletter, demo request) collect, as applicable: e-mail, name, company, phone, tax ID, sector, size, the infrastructure you describe, language and the check's result. We use them to send you what you asked for and to contact you about Defneo.

Legal basis: steps prior to a contract, at your request (Art. 6(1)(b) GDPR) for demos and results; your consent (point (a)) for the newsletter, which you may withdraw at any time; legitimate interest (point (f)) in answering a business enquiry.

Form data is passed to our contact-management tool (CRM). To prevent abuse, the IP address is kept in memory only, for a few minutes, to rate-limit requests. We keep contact data for at most 24 months after the last interaction, or until you ask us to delete it.

The book-a-call button is a link to Calendly; anything you enter there is processed by Calendly under its own policy.

3. Cookies and analytics

We use Google Analytics 4 ONLY if you choose “Accept” in the consent window. Until then the script does not load at all. Advertising purposes (ad_storage, ad_user_data, ad_personalization) are denied even if you accept. Legal basis: consent (Art. 6(1)(a) GDPR and the ePrivacy rules).

Your choice is stored in your browser (localStorage, key “defneo-consent”). You can change it from “Cookie settings” in the footer; on withdrawal we delete the _ga, _ga_* and _gid cookies and reload the page.

The Defneo account uses a single strictly necessary cookie, “dfn_acct” (the sign-in session, HttpOnly, Secure, 30 days), which needs no consent. The site's fonts are self-hosted — nothing is loaded from Google Fonts.

4. The Defneo account

The account has no password: you sign in with a one-time code sent by e-mail, valid for 10 minutes and at most 5 attempts. We keep: e-mail address, language, the version of the terms you accepted, account state, creation and last sign-in dates; for each code and session — a cryptographic digest (never the code itself), the IP address and the time.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for the account and its services; legitimate interest (point (f)) for sign-in IP addresses, used to limit abuse and investigate security incidents.

Codes are sent through an e-mail delivery (SMTP) provider. We keep account data while the account exists; when you ask for deletion, the account and its data are deleted within 30 days, except what the law requires us to keep (for example accounting records).

5. Defneo Community and installation reports

When you sign up for the Community edition we keep your company e-mail, organisation, language, the time and IP address of the sign-up, plus cryptographic digests of the confirmation link and the install token. We use them to deliver the token and protect the service from abuse (contract and legitimate interest).

If an installation fails, the installer sends us a diagnostic report by default: the failing step and reason, versions (OS, kernel, Docker), memory, listening ports, container state and the last lines of the install logs, with secrets masked. The purpose is to fix the installation (legitimate interest). Reporting is turned off with --no-report or DEFNEO_NO_REPORT=1. Reports are deleted automatically after 90 days.

6. Site Shield and the threat feed

Site Shield and the Defneo installations that choose to contribute send our feed server the IP addresses that attacked a site, with the rule triggered, the time and, for Site Shield, the path of the attacking request. Site Shield reports also contain aggregate traffic counts and the site's CMS and plugin inventory. The WordPress plugin sends nothing until you paste a token and has a stop-sharing switch.

Legal basis: the legitimate interest in ensuring network and information security (Art. 6(1)(f) and Recital 49 GDPR). An IP address enters the public feed only after several independent sources report it. Attack details are deleted after 90 days, feed contributions after 30 days.

Mail Shield (part of Site Shield) analyses e-mail inside your hosting account and does not send message content, subjects or recipients outside it.

7. Defneo Cloud

For the Cloud account we act as controller for: the e-mail of the owner and of invited members, their roles and the sign-in log. The data you put into the workspace (compliance, inventory, suppliers, learners, agents) we process only as a processor under the DPA, in a separate database schema for each customer.

8. Security logs

Our servers log, for each request, the IP address, time, path, response code, user agent and referrer, to detect and block attacks (legitimate interest). Logs rotate automatically and are normally kept for a few weeks; security alerts for 14 days.

9. Who receives the data and where it is

The Defneo services run on servers we operate in Romania. We do not sell data and do not use it for advertising.

• the e-mail delivery provider, for sign-in codes and service messages;
• our contact-management tool (CRM), for form and customer data;
• Google Ireland Ltd., only for Google Analytics and only with your consent; Google may transfer data to the US under the EU–US Data Privacy Framework;
• public authorities, only when the law requires it.

10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (including to processing based on legitimate interest), and the right to withdraw consent at any time without affecting earlier processing. Write to office@vaultapps.ro; we answer within one month.

You may lodge a complaint with the Romanian supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro.

We make no decisions based solely on automated processing that produce legal effects on you. The services are not aimed at children.

11. Changes

When we change what data we process we update this page and the version above; for material changes we notify account holders by e-mail.