Privacy Policy

This is a courtesy English translation. The legally binding version is the German Datenschutzerklärung.

Controller

Blackfort Technology UG (haftungsbeschränkt), Ernst-Robert-Curtius-Straße 8A, 53117 Bonn, Germany, info@blackfort-tec.de.

Hosting and server logs

The website runs on a cloud server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which acts as our hosting provider. When you access the website, the server processes technically necessary access data (IP address, date and time, requested address, referrer, browser identifier) in order to deliver the pages and secure operation. The legal basis is Art. 6(1)(f) GDPR. The web server keeps no access log for this website. Technical error messages from the web server and the application are written to the server's system log; error messages from the web server may contain details of the request concerned, including the IP address. They are used for troubleshooting and are deleted as the system log is rotated automatically.

Contact / initial consultation

If you contact us by e-mail, we process your details to handle your request (Art. 6(1)(b)/(f) GDPR). Any further use for advertising purposes only takes place if you have separately and expressly consented (Art. 6(1)(a) GDPR, § 7 UWG); you may withdraw consent at any time.

Contact form

Through the contact form we process your name, your e-mail address, your message and the topic you choose, and on a voluntary basis the approximate number of affected products. The form also transmits the page of this website through which you reached the contact page, where known, and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) if the address of the contact page contains them. We use this origin information to assign your enquiry and to see which content leads to enquiries; we do not use cookies or any persistent browser storage for this; the website keeps the last page viewed only in the memory of the open tab until you close or reload it, and transmits it only when you submit the form. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (answering your enquiry); for the origin information Art. 6(1)(f) GDPR (legitimate interest in evaluating our website). We need your name, e-mail address, topic and message to reply; the number of products is voluntary. To prevent misuse, we keep your IP address in the server's memory for about one hour in order to limit the number of requests. Likewise, we keep your e-mail address in memory for up to 24 hours in order to limit the number of confirmations sent to the same address (at most two per address within 24 hours). We send the enquiry to us and the confirmation to you via the e-mail service Mailjet (Mailjet SAS, Paris, France; Sinch group) as a processor. Within the Sinch group, sub-processors outside the EU, including in the USA, may be involved; the basis is the EU standard contractual clauses (Art. 46(2)(c) GDPR) and, where applicable, the EU-US Data Privacy Framework. We delete enquiries once they have been dealt with, unless a statutory retention obligation applies; enquiries that lead to an engagement are kept with the business records.

Scope check and CVD policy generator

Both tools evaluate your answers and entries in your browser; as long as you do not request an evaluation or support, none of it is transmitted to us. Only when you enter your e-mail address and give your consent do we transmit your e-mail address, optionally your company, and for the scope check the evaluation (schematic product class, urgency, up to three action areas), for the CVD policy generator the security contact entered, the scope, the disclosure period and your choice on the safe harbour clause. For the scope check your browser also sends your individual answers; our server only takes the evaluation from them and discards the individual answers without storing or passing them on. For the scope check we send you the evaluation by e-mail, at most two evaluations per address within 24 hours; if this limit or the daily maximum of confirmation e-mails has been reached, no e-mail is sent. In both cases we contact you about an initial call. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Sending, processing by Mailjet, request limits and retention as for the contact form.

SBOM check

If you select a file in the SBOM check and start the check, your browser transmits its content (an SBOM in CycloneDX or SPDX format or a lockfile, max. 5 MB) and the selected format to our server. A scanning service on the same server keeps the file only in memory, checks it with the osv-scanner tool and deletes it immediately after the check; we do not store it. For the comparison our server queries the package names, versions and package ecosystems of the components it contains from the public vulnerability database OSV.dev, operated by Google LLC (USA). Your IP address and the other content of the file are not transmitted. If the file contains personal data, such as names or e-mail addresses of authors, we process it only for the duration of the check. The legal basis is Art. 6(1)(b) GDPR (check requested by you), otherwise Art. 6(1)(f) GDPR.

Reach measurement (Matomo)

We use Matomo for reach measurement, which we operate ourselves on analytics.blackfort-tec.de. Matomo sets no cookies, does not query device features in the browser for recognition, does not recognise you across devices and works with an anonymised IP address (Art. 6(1)(f) GDPR). It records the pages viewed with referrer, the time spent on them, and clicks on links to other websites and on downloads. Matomo also records the following events: that the consent banner was shown and which choice you made (statistics and marketing, yes or no each); the successful submission of the contact form with the selected topic; for the scope check the start, the number of each question shown (not your answer) and reaching the evaluation, each with the language, plus the reason if the result is "not affected" and the traffic-light level of the evaluation if you request it by e-mail; for the SBOM check the start and completion of the check with the file format, and a failure with the technical error code; for the CVD policy generator copying the security.txt, printing and submitting the request, each with the language. Matomo does not receive names, e-mail addresses, messages or file content. Despite this data minimisation, a residual risk remains that personal data is processed. You can object to this tracking (see "Right to object"); if "Do Not Track" is enabled in your browser, Matomo does not record you.

Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It is only loaded after you have consented to "Statistics" or "Marketing" in the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); before that, no request goes to Google. We also use Google Consent Mode v2: all consent signals are initially set to "denied"; after your consent we release storage access for analytics purposes (statistics) or for advertising purposes (marketing) only for the category you consented to. When it loads, Google receives your IP address and technical information about your browser; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework, additionally standard contractual clauses under Art. 46(2)(c) GDPR).

Advertising and remarketing services

If you have consented to "Marketing" in the consent banner, we load directly on all pages (not via Google Tag Manager): Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for conversion measurement and remarketing, the Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) and the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland), each to measure campaigns and build advertising audiences. These services set cookies or similar identifiers and receive your IP address, the page viewed and browser information. Data may be transferred to Google LLC, Meta Platforms, Inc. and LinkedIn Corporation in the USA (EU-US Data Privacy Framework, additionally standard contractual clauses under Art. 46(2)(c) GDPR); US authorities may access it. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Consent management

On your first visit we use a consent banner to ask for your consent to the categories "Statistics" (Google Tag Manager with storage access for analytics purposes) and "Marketing" (Google Tag Manager and the advertising and remarketing services). Neither category is preselected. We store your choice only locally in your browser (localStorage entry "bf-consent" with your choice and the time); this storage is strictly necessary for consent management (Section 25(2) no. 2 TDDDG). This website itself sets no cookies. Without consent it loads neither Google Tag Manager nor the advertising and remarketing services. You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link at the bottom of the page. If you withdraw marketing consent after the advertising services have loaded, the page reloads so that they stop running; cookies already set by these services can be deleted in your browser settings. After a withdrawal, the website no longer loads Google Tag Manager the next time the page is loaded; until then we inform Google of the withdrawal via Consent Mode.

Local storage in the CRA checklist

In the CRA checklist you can tick off tasks. So that your ticks are still there on your next visit, we store them locally in your browser only when you click (localStorage entries "cra-checklist:…"). This information is not transmitted to us or to third parties and is not analysed. The storage is strictly necessary for the function you use (Section 25(2) no. 2 TDDDG). You can delete the entries at any time via "Reset ticks" or in your browser settings.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). An e-mail to info@blackfort-tec.de is sufficient. You can also object to reach measurement with Matomo via your browser's "Do Not Track" setting.