Privacy policy for hodeishield.com

1.Data controller

Controller

HODEITEK S.L.

Tax ID (NIF)

B56478027

Address

Markole, Aretxabaleta, 20550, Gipuzkoa, Spain

Privacy contact

privacy@hodeitek.com (exercising rights and questions about this policy)

2.Purpose, legal basis and data processed

Demo request or beta program application

• Purpose: handling your demo request or beta program application, contacting you and preparing the session.
• Data: name, work email, company, role, company size, areas of interest and, optionally, a message. For a beta application, instead of the company size and areas of interest: the chosen path (MSSP partner or end organisation), the approximate number of clients (MSSP path only) and the compliance frameworks of interest. The form data is the only data you provide on this site. The origin data described in the next section is added to it.
• Legal basis: taking steps at the data subject's request prior to entering into a contract (Art. 6.1.b GDPR).
• Whether mandatory: the required fields are necessary to process the request; without them it cannot be handled. The message is optional.
• Where it is stored: on receipt, the request is stored in a Hodeitek PostgreSQL database hosted at OVHcloud (EU), through the n8n flow self-hosted by Hodeitek, and the notification email to Hodeitek is then sent through Brevo (processor). This way the request is not lost if the email delivery fails. That copy is deleted automatically 12 months after receipt, within the period stated under Retention. Hodeitek may also send an acknowledgement, likewise through Brevo, to the email address given in the form; its text is fixed and the only data from the request it may include is the name. If you did not make the request, you can ask us to delete the request by writing to info@hodeitek.com.

Origin of the request (demo or beta)

• Purpose: knowing which link or campaign each request comes from, so we can handle it better and see which channels work, and preventing the same request from being counted twice.
• Data: a random submission identifier, the UTM parameters of the landing address (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the origin (domain only, without path or parameters) of the referring page. They are read from the landing address, kept only in the page's memory (not in cookies or browser storage), and sent and stored with your request; they also appear in the internal email notification. Our campaign links contain no data that identifies you, and we discard UTM values that look like an email address, a unique identifier or an opaque code.
• Click identifiers: only those of the active advertising platforms present in the landing address, listed below, are read. They are kept only in the page's memory and are added to your request only if you have accepted advertising. Without that consent they are neither sent nor stored.
• Meta click identifier: fbclid.
• LinkedIn click identifier: li_fat_id.
• Submission identifier in Google Analytics: if you have accepted analytics, the submission identifier is shared with Google Analytics as the conversion identifier, so the same request is not counted twice.
• Submission identifier on advertising platforms: if you have accepted advertising, the submission identifier is also shared with those platforms as the conversion identifier, so the same conversion is not counted twice.
• Because that identifier is also stored with your request, Hodeitek can link the conversion each platform measures to your request. The platforms do not receive the form data.
• Legal basis: Hodeitek's legitimate interest in knowing where the requests it receives come from and measuring its channels (Art. 6.1.f GDPR). We have weighed that interest against your rights: this is campaign data that does not identify anyone on its own and only accompanies a request you send.
• Legal basis for click identifiers: your consent (Art. 6.1.a GDPR).
• Your right to object: you can object to this processing at any time by writing to privacy@hodeitek.com. We will delete the origin data from your request without affecting how it is handled.

Security and abuse prevention

• Purpose: telling human submissions from automated ones and limiting abuse of the form.
• Data: IP address and technical browser data, processed by Cloudflare Turnstile and by the server for verification and rate limiting (the IP only in memory, never written to logs). In the server's technical logs, one line per submission with a random identifier, the outcome, the language, the role, the request type and an irreversible keyed hash of the email address, without the address itself or your name, message or IP. These logs are kept only while the server instance that generated them is running and are deleted when it is replaced (which happens on every deployment), with a size limit that removes the oldest entries earlier.
• Legal basis: Hodeitek's legitimate interest in the security of the Website (Art. 6.1.f GDPR).

Web analytics

• Purpose: statistically measuring how the site is used (pages visited, calls to action clicked and demo or beta requests completed) in order to improve it and, through the Google Ads link, knowing which ads lead to a request. Tool: Google Analytics 4.
• Data: online identifiers (Google Analytics first-party cookies), pseudonymised usage data, approximate location inferred by Google, device and browser data and, when a demo or beta request is completed, the request type and the submission identifier. The content of the form is not sent.
• Link with Google Ads: Hodeitek's Google Analytics property is linked to its Google Ads account to import completed requests as conversions. So, if you accept analytics, Google Ads receives through that link the data of those conversions measured in Google Analytics. If you have not accepted advertising, Google receives with it the signal that you do not consent to the use of your data for advertising purposes (see “Google Consent Mode” in the Cookie Policy).
• Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). It is only activated if you accept the analytics category.
• Retention: 14 months in Google Analytics.

Advertising measurement and audiences

• Purpose: measuring whether Hodeitek's ads on these platforms end in a demo or beta request (conversions) and, where the platform allows it, building audiences to show ads again to people who have visited the site.
• Tool: Meta Pixel (Meta Platforms Ireland Limited).
• Tool: LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company).
• Data: online and advertising identifiers (cookies and click identifiers), IP address and device and browser data received by each platform, pages visited and the completed demo or beta request event, with the submission identifier. The event does not include the content of the form.
• Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). It is only activated if you accept the advertising category.
• Retention: set by each platform under its policy (cookies expire as detailed in the Cookie Policy).

Consent log

• Purpose: being able to show that you accepted, rejected or withdrew consent, and under which version of the policy and banner.
• Data: a random identifier of the decision (it does not identify you), the date, the expiry date, your choice per category, the type of action (accept, reject, customise or withdraw), the policy and banner versions, the language, the list of providers shown, the time of receipt and an integrity signature. We do not store your IP address, browser identifier (user agent), cookies, email or name.
• Legal basis: compliance with the legal obligation to be able to demonstrate that you consented or withdrew consent (Art. 6.1.c GDPR, read with Arts. 7.1 and 5.2 GDPR). When you reject, we keep that decision on the basis of Hodeitek's legitimate interest in being able to show that it was respected (Art. 6.1.f GDPR). The entry does not identify you, and you can object by writing to privacy@hodeitek.com with your decision identifier.
• Retention: 3 years from the date your decision expires (13 months after you make it), the limitation period for very serious infringements (Art. 72.1 LOPDGDD). During that time the entry is blocked and used only to prove consent to authorities or courts (Art. 32 LOPDGDD).
• Where it is stored: in a Hodeitek PostgreSQL database hosted at OVHcloud (EU), through the n8n instance Hodeitek operates.

Hodeitek does not build profiles from the form data, does not take automated decisions with legal effects and does not use form data to send newsletters or advertising. We will only write to you about your request and, if you take part in the beta, about the program and what comes next, including the paid-plan offer set out in its terms.

3.Recipients and processors

Data is not disclosed to third parties except where legally required and, for analytics and advertising, to the providers listed below and only if you consent. The following providers access the form data and the consent log as processors under a contract compliant with Article 28 GDPR:

Analytics and advertising (only with your consent)

If you accept the relevant categories, your browser communicates directly with the following providers. For the measurement they provide to Hodeitek they act as processors; in addition, for certain processing they act as independent controllers or joint controllers for their own purposes (for example, improving their services and their advertising). Under the case law of the Court of Justice of the EU (Fashion ID, Case C-40/17), embedding a third party's module in a website can give rise to joint responsibility for the collection and transmission of data to that third party. For the collection and transmission of data to the platform, Hodeitek is responsible for obtaining your consent and informing you; the platform is responsible for its subsequent processing and for handling rights over it. Until you choose, none of them is loaded.

4.International transfers

Cloudflare, Inc. is a US company and may process data in the United States (Cloudflare's network acts as CDN and anti-bot check on the request path, so visits to the Website also pass through it). Following the judgment of the Court of Justice of the EU of 16 July 2020 (Case C-311/18, “Schrems II”), the transfer relies on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), which recognises an adequate level of protection for certified US entities (Cloudflare, Inc. was listed as an active participant on the official list at the date of this policy) and, should the DPF cease to apply, on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) incorporated in the contract. Because Cloudflare terminates the encrypted connection, it also sees form content in transit.

Microsoft 365 processes data in the EEA; occasional access by Microsoft Corporation (USA) relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

The analytics and advertising providers listed above have companies in Ireland and parent companies in the United States, so data collected with your consent may be processed in the United States. Those transfers rely on the adequacy decision of the EU-U.S. Data Privacy Framework (10 July 2023) for entities certified at the date of this policy and, should the DPF cease to apply, on the Standard Contractual Clauses those providers incorporate in their terms.

Website hosting, the request flow and the consent log (OVHcloud, Hodeitek's n8n instance and Brevo) are located in the European Union.

5.Retention

6.Your rights

Under Articles 15 to 22 GDPR you may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw at any time any consent you have given, without affecting the lawfulness of prior processing (Art. 7.3 GDPR).

Right to object. Where we process data on the basis of legitimate interest (origin of the request, form security or recording a cookie rejection), you may object at any time on grounds relating to your particular situation by writing to privacy@hodeitek.com. We will stop unless there are compelling legitimate grounds or the data is needed to defend legal claims (Art. 21 GDPR).

For analytics and advertising, withdrawing consent is as easy as giving it: click “Cookie settings” in the footer of any page, switch the categories off and save. It takes effect immediately. To locate your consent log entry, tell us the decision identifier shown in your browser's local storage (key hodeishield-consent-v1); because we do not store your IP or other data that identifies you, without that identifier we cannot link an entry to a person (Art. 11 GDPR).

• Data that Google processes as an independent or joint controller can also be managed with Google, through the tools and channels it describes in its privacy policies.
• Data that Meta processes as an independent or joint controller can also be managed with Meta, through the tools and channels it describes in its privacy policies.
• Data that LinkedIn processes as an independent or joint controller can also be managed with LinkedIn, through the tools and channels it describes in its privacy policies.

To exercise them, write to privacy@hodeitek.com stating the right. If you write from the address you gave us, nothing else is needed; we will only ask for additional information to verify your identity if we have reasonable doubts (Art. 12.6 GDPR). We will reply within one month, extendable by two further months for complex requests (Art. 12.3 GDPR).

If you believe the processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, or via its website www.aepd.es.

7.Minors

The Website is aimed at companies and professionals, not at minors. Hodeitek does not knowingly collect data from children under 14 (Art. 7 LOPDGDD) and will delete it as soon as it becomes aware of it.

8.Cookies

This site only sets analytics and advertising cookies or similar technologies with your prior consent (Art. 22.2 LSSI-CE and Art. 6.1.a GDPR), which you can accept, reject or withdraw at any time. Until you choose, none is loaded and no data is sent to those providers. Strictly necessary technologies do not require consent. The detail of each cookie (name, provider, purpose, duration and category) and how to manage them is in the Cookie Policy.

9.Security measures

Hodeitek applies appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (HTTPS/TLS), security headers with a restrictive content policy, anti-abuse verification of the form and access control on the systems that receive requests. You can report vulnerabilities to security@hodeitek.com.

10.Changes to this policy

Hodeitek may update this policy to reflect legal or service changes. The date of the last update appears at the top of the document.

If this policy, the cookie policy or the list of analytics and advertising providers changes materially, we will ask for your choice again.