Privacy policy
This page explains what happens to your information when you visit defencelab.io, send us an enquiry or use the security health check. It covers this website only. Data we handle for clients during an engagement is governed by the contract and data processing agreement for that engagement.
Who we are
This site is operated by DefensiveLaboratory OÜ, a private limited company registered in the Estonian Commercial Register under registry code 16951341, at Vesivärava tn 50-201, 10152 Tallinn, Estonia. In this policy, "Defence Lab", "we" and "us" mean that company.
We decide how and why your information is used, which makes us the controller under the EU General Data Protection Regulation (GDPR).
- Legal entity
- DefensiveLaboratory OÜ, private limited company, Estonian Commercial Register
- Registry code
- 16951341
- Address
- Vesivärava tn 50-201, 10152 Tallinn, Estonia
- Contact
- contact@defencelab.io
For anything about your data, write to contact@defencelab.io.
What we collect, and why
| What you do | What we get | What we use it for | Legal basis (GDPR) |
|---|---|---|---|
| Send the contact form or email us | Name, work email, company, team size, the kind of situation, your description, or whatever you write in an email | Replying to you and the conversation that follows | Art. 6(1)(b), steps you asked for before a possible contract |
| Ask for the health check PDF | Your email address and your answers | Preparing and sending you the PDF | Art. 6(1)(b) |
| Read the site | IP address, browser type, pages requested, time of the request, kept in server logs | Keeping the site working and secure | Art. 6(1)(f), our legitimate interest |
You can answer the health check questions and see your result without giving us anything.
The form and the health check ask about your company's security, not about you personally. Please don't send us passwords, access keys or customer data in a message. If you are dealing with an incident, describe what is happening and we will agree a safe way to exchange evidence.
We don't sell your information. We don't add you to a mailing list because you sent an enquiry or used the health check, and we don't use it for automated decisions about you.
Who else handles your information
Our team
Only the people at Defence Lab who answer enquiries read what you send.
Our providers
We use these providers to run the site and our mail:
- Cloud hosting provider: hosting and server logs, Spain (EU)
- Google (Google Workspace): our mailboxes, where enquiries arrive, EU and United States
Each of them works on our instructions under a data processing agreement and may not use your information for its own purposes.
Transfers outside the EU
Our site is hosted in the EU. Google, our email provider, may process data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, and those transfers are also covered by the European Commission's Standard Contractual Clauses in Google's data processing terms.
How long we keep it
Enquiries, emails and health check requests, if no work starts: kept for 24 months after the last message, then deleted.
Server logs: kept for a short period set by our hosting provider, then deleted automatically.
Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you and give you a copy
- correct it
- delete it
- restrict how we use it
- send it to you in a portable format
- stop using it where we rely on our legitimate interest
Write to contact@defencelab.io. We reply within one month. If we need to confirm it's you, we'll ask for as little as possible.
If something goes wrong
If you think we've handled your information badly, tell us first and we'll try to put it right. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the authority in the EU country where you live or work.
Changes to this policy
When we change this page, we update the date at the top.